Topics

Der OPNSense community,

We use dedicated machine without network connectivity to create and revoke OpenVPN certificates. Up to version 22.1 our workflow was always to generate crl.pem on the off-line mahine and manually upload it to the OPNSense gateway.

With 22.7 when going to System => Trust => Revocation and clicking on edit of existing CRL, there is no option to update its content. See attached picture. The workaround seems to be to import new CRL, and than modify the OpenVPN to use that new CRL and than delete the old one.

It was much easier, when we could just edit the existing one. Any hints?

Thanks,
Radek

We activated following two functionalities in our Unbound settings:

Register DHCP leases
Register DHCP static mappings

As we would like to use both, we still need to give higher priority to the static mapping, so in case some evil colleague use some name for which we already have static mapping (such as jenkinsserver) on his desktop, the legitimate server does not get overridden by the dynamic DHCP lease.

We tried to work around it, by adding the static mappings also as the Unbound overrides, but that did not help as described here
https://forum.opnsense.org/index.php?topic=20185.0 or https://forum.opnsense.org/index.php?topic=21757.0

Any ideas what else to try?

Thanks,
Radek