Bernhard.Linz/openvpn-install
1
0
Fork 0
mirror of https://github.com/angristan/openvpn-install.git synced 2025-12-29 22:27:03 +01:00
Code Issues Projects Releases Wiki Activity

fix: remove all old cert files before renewal in fingerprint mode

Browse Source
This commit is contained in:
Stanislas Lange
2025-12-29 11:12:19 +01:00
parent a3d720c593
commit 80778b925b
1 changed files with 5 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
openvpn-install.sh
View File

@@ -4120,13 +4120,15 @@ function renewClient() {
if [[ $auth_mode == "fingerprint" ]]; then if [[ $auth_mode == "fingerprint" ]]; then
# Fingerprint mode: cannot use easyrsa renew (requires CA) # Fingerprint mode: cannot use easyrsa renew (requires CA)
# Instead: delete old cert, generate new self-signed, update fingerprint # Instead: delete old cert/key/req, generate new self-signed, update fingerprint
# Remove old certificate files (keep the key for continuity, or regenerate) # Remove old certificate files (all must be removed for self-sign-client to work)
run_cmd "Removing old certificate" rm -f "pki/issued/$CLIENT.crt" run_cmd "Removing old certificate" rm -f "pki/issued/$CLIENT.crt"
run_cmd "Removing old private key" rm -f "pki/private/$CLIENT.key"
run_cmd "Removing old request" rm -f "pki/reqs/$CLIENT.req"
# Generate new self-signed certificate # Generate new self-signed certificate
run_cmd_fatal "Generating new certificate" ./easyrsa --batch self-sign-client "$CLIENT" nopass run_cmd_fatal "Generating new certificate" ./easyrsa --batch --days="$client_cert_duration_days" self-sign-client "$CLIENT" nopass
# Extract new fingerprint # Extract new fingerprint
local new_fingerprint local new_fingerprint