I used to run a SoftEther VPN to expose an OpenVPN connection to my house, and that was great until it randomly stopped working (sometime after I switched to certificate-based connections). So last year, I switched to running a plain old OpenVPN server with easyrsa and a couple helper shell scripts.
And that was great until it randomly stopped working. At first, I thought that it was the FydeOS Android subsystem on my work computer that was causing problems, but when I tried to VPN from my phone, it wouldn't work, either. It just sat there for a minute and then timed out.
When I checked the logs (/var/log/syslog), I saw this:
openvpn[557]: X.X.X.X:35633 VERIFY ERROR: depth=0, error=CRL has expired: CN=XXXX, serial=XXXX
The short version of the story is that the certificate revocation list (CRL) that I set up only has a lifetime of 180 days by default, and once it expires, OpenVPN doesn't work at all.
The solution was just to regenerate the CRL:
./easyrsa gen-crl
That created a new "crl.pem" file that just needed to be copied to "/etc/openvpn/server/".
The main trick is to make the lifetime a lot longer (such as 10 years). You can add that to your easyrsa "vars" file with this line:
set_var EASYRSA_CRL_DAYS 3650
Once the CRL is generated with that variable set, it'll have a 10-year expiration date.
So, in addition to my "create-client-profile.sh" and "revoke-client-profile.sh" scripts, I added a "regenerate-certificate-revocation-list.sh" script.
With that, this hopefully shouldn't bite me again. And if it does, it's just a one-liner to get it back up and running.