I’m using easy-rsa version 3.2 to create client certificates for my VPN which is set up on AWS. I have created a certificate by running:
<code>./easyrsa build-client-full test-user nopass
</code>
<code>./easyrsa build-client-full test-user nopass
</code>
./easyrsa build-client-full test-user nopass
Then when this certificate expires in 825 days, I will run:
<code>./easyrsa expire test-user
</code>
<code>./easyrsa expire test-user
</code>
./easyrsa expire test-user
Then I will renew the certificate by running:
<code>./easyrsa sign-req client test-user
</code>
<code>./easyrsa sign-req client test-user
</code>
./easyrsa sign-req client test-user
All well so far. However, when this certificate expires again, I’m not sure how to renew it. If I run ./easyrsa expire user-cert again I get:
<code>Error
-----
Existing file must be revoked:
* /easy-rsa/easyrsa3/pki/expired/test-user.crt
</code>
<code>Error
-----
Existing file must be revoked:
* /easy-rsa/easyrsa3/pki/expired/test-user.crt
</code>
Error
-----
Existing file must be revoked:
* /easy-rsa/easyrsa3/pki/expired/test-user.crt
Should I then run ./easyrsa revoke test-user and ./easyrsa build-client-full user-cert nopass? It seems to work but I really don’t understand the terminology here.
Is this the correct way to renew a certificate that has already been renewed one time?