Add note about file permissions and --crl-verify to manpage.

Trac #522

Signed-off-by: Gert Doering <gert@greenie.muc.de>
Acked-by: Steffan Karger <steffan.karger@fox-it.com>
Message-Id: <1430593625-855-1-git-send-email-gert@greenie.muc.de>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9634

diff --git a/doc/openvpn.8 b/doc/openvpn.8
index 587b7697ab7f5bf63169717ce9f414a51fb5da06..b09f7d7c65997ce9e89572ccc5a53987eb9fdb4f 100644 (file)
--- a/doc/openvpn.8
+++ b/doc/openvpn.8
@@ -5068,6 +5068,11 @@ is a directory containing files named as revoked serial numbers
 requests a connection, where the client certificate serial number
 (decimal string) is the name of a file present in the directory,
 it will be rejected.
+
+Note: As the crl file (or directory) is read every time a peer connects,
+if you are dropping root privileges with
+.B --user,
+make sure that this user has sufficient privileges to read the file.
 .\"*********************************************************
 .SS SSL Library information:
 .\"*********************************************************