# Check which pfSense VPN instances consume a certificate revocation list

> Several CRLs for one issuer can have different effects depending on the VPN service.

- Canonical URL: https://update.dsesecurity.com/updates/check-which-pfsense-vpn-instances-consume-a-certificate-revocation-list/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-20T18:16:14+00:00
- Modified: 2026-10-20T18:34:35+00:00
- Last reviewed by DSE: 2026-10-20
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

Several CRLs for one issuer can have different effects depending on the VPN service.

## Potentially affected

This concerns pfSense CRL consumption and management.

## DSE recommendation

DSE recommends mapping each CRL to its issuer, issuing authority, expiry, and consuming services.

## Article

Several CRLs for one issuer can have different effects depending on the VPN service.

## Source facts

Netgate permits several CRLs for one CA. OpenVPN instances can select different lists, allowing a certificate to be denied on one instance and accepted on another. IPsec consults all CRLs instead of selecting one per instance. Adding entries to an imported CRL is not supported locally; that list must be updated from its external issuer workflow.

Source: [Netgate — Certificate Revocation List Management](https://docs.netgate.com/pfsense/en/latest/certificates/crl.html).

## Applicability

This concerns pfSense CRL consumption and management.

## DSE recommendation

DSE recommends mapping each CRL to its issuer, issuing authority, expiry, and consuming services. Make the offboarding decision explicit: revoke across all uses, or intentionally restrict one OpenVPN instance. Avoid creating service-specific exceptions that are assumed to behave identically in IPsec. If the CA is external, arrange a documented import and update process with its owner rather than trying to edit the imported list inside the firewall. Make the acceptance matrix specific to VPN instances rather than just certificate names. Ask the VPN owner to identify where a deliberately revoked test identity must fail and where it should remain usable. Document the update owner for each externally issued list before relying on it operationally.

## Verification

Use a nonproduction revoked certificate to attempt new authentication against each relevant instance, alongside a valid control certificate. Confirm the intended rejection or exception and inspect list selection. Record the current CRL version and validity so a later import does not silently reverse the intended access decision.

## Official reference

[Netgate — Certificate Revocation List Management](https://docs.netgate.com/pfsense/en/latest/certificates/crl.html). Reviewed October 20, 2026.

## Primary reference

- Name: Netgate — Certificate Revocation List Management
- Authority: docs.netgate.com
- URL: https://docs.netgate.com/pfsense/en/latest/certificates/crl.html
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Check which pfSense VPN instances consume a certificate revocation list,” DSE Security, https://update.dsesecurity.com/updates/check-which-pfsense-vpn-instances-consume-a-certificate-revocation-list/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.