1. 修改配置文件
      etc/ocserv/ocserv.conf

    开启吊销功能:

    1. # The revocation list of the certificates issued by the 'ca-cert' above.
    2. # See the manual to generate an empty CRL initially. The CRL will be reloaded
    3. # periodically when ocserv detects a change in the file. To force a reload use
    4. # SIGHUP.
    5. crl = /etc/ocserv/certificates/crl.pem
    1. 进入 /etc/ocserv/certificates/certs 将需要吊销的用户的pem证书复制到 /etc/ocserv/certificates
    2. 运行 
      1. certtool --generate-crl --load-ca-privkey ca-key.pem --load-ca-certificate ca-cert.pem --load-certificate denniszhou.pem --template crl.tmpl --outfile crl.pem

    4.需要重启ocserv服务才能生效

    1. systemctl restart ocserv
    2. systemctl status ocserv

    who 查看登录用户

    5.后续 删除复制到/etc/ocserv/certificates下的用户pem证书，将/etc/ocserv/certificates/certs下吊销用户的所有证书移动到expire文件夹下。

    取消吊销证书:

    1. certtool --generate-crl --load-ca-privkey ca-key.pem --load-ca-certificate ca-cert.pem --template crl.tmpl --outfile crl.pem