Get your crl.pem expir date: Renew your crl.pem: It seems there is no –days argument, crl.pem’s are valid for 180 days You can change that value by tuning the easyrsa script: search for CRL_DAYS