Check which pfSense VPN instances consume a certificate revocation list

Several CRLs for one issuer can have different effects depending on the VPN service.

Source facts

Netgate permits several CRLs for one CA. OpenVPN instances can select different lists, allowing a certificate to be denied on one instance and accepted on another. IPsec consults all CRLs instead of selecting one per instance. Adding entries to an imported CRL is not supported locally; that list must be updated from its external issuer workflow.

Source: Netgate — Certificate Revocation List Management.

Applicability

This concerns pfSense CRL consumption and management.

DSE recommendation

DSE recommends mapping each CRL to its issuer, issuing authority, expiry, and consuming services. Make the offboarding decision explicit: revoke across all uses, or intentionally restrict one OpenVPN instance. Avoid creating service-specific exceptions that are assumed to behave identically in IPsec. If the CA is external, arrange a documented import and update process with its owner rather than trying to edit the imported list inside the firewall. Make the acceptance matrix specific to VPN instances rather than just certificate names. Ask the VPN owner to identify where a deliberately revoked test identity must fail and where it should remain usable. Document the update owner for each externally issued list before relying on it operationally.

Verification

Use a nonproduction revoked certificate to attempt new authentication against each relevant instance, alongside a valid control certificate. Confirm the intended rejection or exception and inspect list selection. Record the current CRL version and validity so a later import does not silently reverse the intended access decision.

Official reference

Netgate — Certificate Revocation List Management. Reviewed October 20, 2026.