---
title: 'Tutorial: Revoke or Delete a User Certificate or Profile'
canonical: https://openvpn.net/as-docs/tutorials/tutorial--revoke-user-certificate/
product: Access Server Docs
description: How to revoke user certificates and connection profiles for OpenVPN Access Server.
---

# Tutorial: Revoke or Delete a User Certificate or Profile

## Overview

This tutorial provides instructions for revoking the user certificates for your VPN clients connecting to Access Server.

Revoking or deleting a user certificate or profile removes it from the Access Server certificates database, but the action does not block the user. After revocation, when the user attempts to connect with that profile, they receive an “authentication failed” message stating that the certificate has been revoked. The user must then delete the profile and import a new one; at this point, Access Server generates a new certificate and profile.

As of Access Server version 2.9, users can have multiple active profiles. You can manage user profiles on the User Profiles page in the Admin Web UI.

## Prerequisites

- An installed Access Server.
- VPN users.
- Admin Web UI access or console access.

## Option 1: Revoke or delete user certificates and profiles in the Admin Web UI

Follow the steps for your Access Server version.

> **Tip**
>
> We recommend running the [latest version](https://openvpn.net/as-docs/tutorials/tutorial--update-access-server.md).

### Access Server 2.9 and newer

1. Sign in to the Admin Web UI.
2. Click **User Management \> User Profiles**.
3. Click the drop-down next to the user.
4. Click **Delete** for the profile and its associated certificate.
5. Click **Delete**.

> **Note**
>
> An administrator can revoke one profile at a time or all associated user profiles simultaneously.

### Access Server 2.8 and older

1. Sign in to the Admin Web UI.
2. Click **User Management \> Revoke Certificates**.
3. Check the box under **Revoke** for the appropriate client certificate.
4. Click **Revoke**

## Option 2: Revoke or delete user certificates and profiles from the command-line interface (CLI)

You can revoke certificates or profiles from your Access Server CLI. These commands use the **sa** tool, the **sacli** tool, and the **confdba** tool.

1. Connect to your console and get root privileges.
2. Switch to the scripts directory:

   ```
   cd /usr/local/openvpn_as/scripts/
   ```
3. Run the desired commands from one of the sections below with the appropriate CLI tool.

### sa tool commands

- Delete the oldest user-locked profile for a user:

  ```
  ./sa DeleteClient [username]
  ```
- Delete the oldest autologin profile:

  ```
  ./sa DeleteClient [username]_AUTOLOGIN
  ```
- Delete a profile by its serial number:

  ```
  ./sa DeleteClientSN [serial number]
  ```

  The serial number for a profile displays in the Admin Web UI on the **User Profiles** page. You can also check it from CLI with`./sa listclientsdetail` or `./sacli listclientsdetail`.

### sacli tool commands

- Revoke all certificates for the user:

  ```
  ./sacli --user [username] RevokeUser
  ```
- Revoke the oldest user-locked certificate with a specific common name:

  ```
  ./sacli --cn [common name] RevokeUserProfile
  ```
- Revoke the oldest autologin certificate with a specific common name:

  ```
  ./sacli --cn [common name]_AUTOLOGIN RevokeUserProfile
  ```
- Revoke a certificate by its serial number:

  ```
  ./sacli --sn [serial number] RevokeUserProfile
  ```

  The serial number for a profile displays in the Admin Web UI on the **User Profiles** page. You can also check it from CLI with`./sa listclientsdetail` or `./sacli listclientsdetail`.

### confdba command

- Prevent a user from getting a new certificate from the Client UI or a VPN client after revocation:

  ```
  ./confdba -u --mod --prof [username] --key prop_deny --value true
  ```

## Troubleshooting: Authentication Failed — REVOKED: client certificate has been revoked

When a user receives the message “REVOKED: client certificate has been revoked” in OpenVPN Connect, their imported certificate/profile has been revoked in the Access Server certificates database. To resolve the error:

1. Click **Edit** for the profile.
2. Click **Delete Profile**.
3. Click **Yes**.
4. Click the **Add** icon.
5. Enter the URL for Access Server and click **Next**.
6. Enter the username and password and click **Import**.

---

Prev: [Certificates and Client Authentication](https://openvpn.net/as-docs/tutorials/certificates-and-client-authentication.md)
Next: [Tutorial: Extract Separate Certificate Files for a User](https://openvpn.net/as-docs/tutorials/tutorial--extract-separate-cert-files.md)
Index: https://openvpn.net/as-docs/llms.txt