cd /etc/openvpn/easy-rsa/
source ./vars >/dev/null
# openssl ca -gencrl -out "crl.pem" -config "$KEY_CONFIG"  #does not work
./revoke-full revoked
cp keys/crl.pem /etc/openvpn/