Tutorial: Revoke or Delete a User Certificate or Profile⁠

Overview⁠

This tutorial provides instructions for revoking the user certificates for your VPN clients connecting to Access Server.

Revoking or deleting a user certificate or profile removes it from the Access Server certificates database, but the action does not block the user. After revocation, when the user attempts to connect with that profile, they receive an “authentication failed” message stating that the certificate has been revoked. The user must then delete the profile and import a new one; at this point, Access Server generates a new certificate and profile.

As of Access Server version 2.9, users can have multiple active profiles. You can manage user profiles on the User Profiles page in the Admin Web UI.

Follow the steps for your Access Server version.

You can revoke certificates or profiles from your Access Server CLI. These commands use the sa tool, the sacli tool, and the confdba tool.

Connect to your console and get root privileges.
Switch to the scripts directory:
```
cd /usr/local/openvpn_as/scripts/
```
Run the desired commands from one of the sections below with the appropriate CLI tool.

sa tool commands⁠

Delete the oldest user-locked profile for a user:
```
./sa DeleteClient [username]
```
Delete the oldest autologin profile:
```
./sa DeleteClient [username]_AUTOLOGIN
```
Delete a profile by its serial number:
```
./sa DeleteClientSN [serial number]
```
1. The serial number for a profile displays in the Admin Web UI on the User Profiles page. You can also check it from CLI with ./sa listclientsdetail or ./sacli listclientsdetail.

sacli tool commands⁠

Revoke all certificates for the user:
```
./sacli --user [username] RevokeUser
```
Revoke the oldest user-locked certificate with a specific common name:
```
./sacli --cn [common name] RevokeUserProfile
```
Revoke the oldest autologin certificate with a specific common name:
```
./sacli --cn [common name]_AUTOLOGIN RevokeUserProfile
```
Revoke a certificate by its serial number:
```
./sacli --sn [serial number] RevokeUserProfile
```
1. The serial number for a profile displays in the Admin Web UI on the User Profiles page. You can also check it from CLI with ./sa listclientsdetail or ./sacli listclientsdetail.

confdba command⁠

Prevent a user from getting a new certificate from the Client UI or a VPN client after revocation:
```
./confdba -u --mod --prof [username] --key prop_deny --value true
```

Can't find what you're looking for?

Our support team will be happy to assist you.

Contact Support Schedule a Demo

Tutorial: Revoke or Delete a User Certificate or Profile⁠

Overview⁠

Was this information helpful?