diff --git a/config/ovpn/ovpn_crl_updater.sh b/config/ovpn/ovpn_crl_updater.sh
new file mode 100644
index 0000000..309edc2
--- /dev/null
+++ b/config/ovpn/ovpn_crl_updater.sh
@@ -0,0 +1,53 @@
+#!/bin/bash
+
+#
+# Script Name: ovpn_crl_updater.sh
+# Description: This script checks the "Next Update:" field of the CRL and renews it if needed,
+#     which prevents the expiration of OpenVPNs CRL.
+#     With OpenVPN 2.4.x the CRL handling has been refactored,
+#     whereby the verification logic has been removed from ssl_verify_<backend>.c .
+#     See for more infos:
+#     https://github.com/OpenVPN/openvpn/commit/160504a2955c4478cd2c0323452929e07016a336
+#
+# Run Information: If OpenVPNs CRL is presant, 
+#     this script provides a cronjob which checks daily if an update of the CRL is needed.
+#     If the expiring date reaches the value (defined in the 'UPDATE' variable in days)
+#     before the CRL expiration, an openssl command will be executed to renew the CRL.
+#     The renewing of the CRL will be logged into /var/log/messages.
+# 
+# Author: Erik Kapfer
+#
+# Date: 17.01.2018
+#
+###############################################################################################
+
+# Check if OpenVPN is active or if the CRL is presant
+if [ ! -e "/var/ipfire/ovpn/crls/cacrl.pem" ]; then
+	exit 0;
+fi
+
+## Paths
+OVPN="/var/ipfire/ovpn";
+CRL="${OVPN}/crls/cacrl.pem";
+CAKEY="${OVPN}/ca/cakey.pem";
+CACERT="${OVPN}/ca/cacert.pem";
+OPENSSLCONF="${OVPN}/openssl/ovpn.cnf";
+## Values
+# CRL check for the the 'Next Update:' in seconds
+EXPIRINGDATEINSEC="$(( $(date -d "$(openssl crl -in "${CRL}" -text | grep -oP 'Next Update: *\K.*')" +%s) - $(date +%s) ))";
+# Day in seconds to calculate
+DAYINSEC="86400";
+# Convert seconds to days
+NEXTUPDATE="$((EXPIRINGDATEINSEC / DAYINSEC))";
+# Update of the CRL in days before CRL expiring date
+UPDATE="2";
+
+# Check if OpenVPNs CRL needs to be renewed
+if [ "${NEXTUPDATE}" -le "${UPDATE}" ]; then
+	openssl ca -gencrl -keyfile "${CAKEY}" -cert "${CACERT}" -out "${CRL}" -config "${OPENSSLCONF}";
+	logger -t openssl "OpenVPN CRL has been renewed";
+fi
+
+exit 0
+
+# EOF
diff --git a/lfs/openvpn b/lfs/openvpn
index a925f78..1e1ddc2 100644
--- a/lfs/openvpn
+++ b/lfs/openvpn
@@ -96,6 +96,10 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	mv -v /var/ipfire/ovpn/verify /usr/lib/openvpn/verify
 	chown root:root /usr/lib/openvpn/verify
 	chmod 755 /usr/lib/openvpn/verify
+	# Add crl updater
+	mv -v /var/ipfire/ovpn/ovpn_crl_updater.sh /etc/fcron.daily
+	chown root:root /etc/fcron.daily/ovpn_crl_updater.sh
+	chmod 750 /etc/fcron.daily/ovpn_crl_updater.sh
 
 	@rm -rf $(DIR_APP)
 	@$(POSTBUILD)