Login or Register to Ask a Question and Join Our Community

Linux and UNIX Man Pages

Linux & Unix Commands - Search Man Pages

strongimcv_pki---signcrl(1) [centos man page]

PKI --SIGNCRL(1)						    strongSwan							  PKI --SIGNCRL(1)

NAME

       pki --signcrl - Issue a Certificate Revocation List (CRL) using a CA certificate and key

SYNOPSIS

       pki --signcrl --cakey file|--cakeyid hex --cacert file [--lifetime days] [--lastcrl crl] [--basecrl crl] [--crluri uri] [--digest digest]
		     [[--reason reason] [--date ts] --cert file|--serial hex] [--outform encoding] [--debug level]

       pki --signcrl --options file

       pki --signcrl -h | --help

DESCRIPTION

       This sub-command of pki(1) is used to issue a Certificate Revocation List (CRL) using a CA certificate and private key.

OPTIONS

       -h, --help
	      Print usage information with a summary of the available options.

       -v, --debug level
	      Set debug level, default: 1.

       -+, --options file
	      Read command line options from file.

       -k, --cakey file
	      CA private key file. Either this or --cakeyid is required.

       -x, --cakeyid hex
	      Key ID of a CA private key on a smartcard. Either this or --cakey is required.

       -c, --cacert file
	      CA certificate file. Required.

       -l, --lifetime days
	      Days until the CRL gets a nextUpdate, default: 15.

       -a, --lastcrl crl
	      CRL of lastUpdate to copy revocations from.

       -b, --basecrl crl
	      Base CRL to create a delta CRL for.

       -u, --crluri uri
	      Freshest delta CRL URI to include in CRL. Can be used multiple times.

       -g, --digest digest
	      Digest to use for signature creation. One of md5, sha1, sha224, sha256, sha384, or sha512. Defaults to sha1.

       -f, --outform encoding
	      Encoding of the created certificate file. Either der (ASN.1 DER) or pem (Base64 PEM), defaults to der.

   Revoked Certificates
       Multiple revoked certificates can be added to the CRL by either providing the certificate file or the respective serial number directly.  A
       reason and a timestamp can be configured for each revocation (they have to be given before each certificate/serial on the command line).

       -r, --reason reason
	      The  reason  why	the  certificate  was  revoked.  One  of  key-compromise,  ca-compromise,  affiliation-changed, superseded, cessa-
	      tion-of-operation, or certificate-hold.

       -d, --date ts
	      Revocation date as Unix timestamp. Defaults to the current time.

       -z, --cert file
	      Certificate file to revoke.

       -s, --serial hex
	      Hexadecimal encoded serial number of the certificate to revoke.

EXAMPLES

       Revoke a certificate:

	 pki --signcrl --cacert ca_cert.der --cakey ca_key.der 
	     --reason superseded --cert cert.der > crl.der

       Update an existing CRL with two new revocations, using the certificate's serial number, but no reason:

	 pki --signcrl --cacert ca_cert.der --cakey ca_key.der 
	     --lastcrl old_crl.der --serial 0123 --serial 0345 > crl.der

SEE ALSO

       pki(1)

5.1.1								    2013-08-12							  PKI --SIGNCRL(1)

Check Out this Related Man Page

CRL(1)								      OpenSSL								    CRL(1)

NAME

       crl - CRL utility

SYNOPSIS

       openssl crl [-inform PEM|DER] [-outform PEM|DER] [-text] [-in filename] [-out filename] [-noout] [-hash] [-issuer] [-lastupdate]
       [-nextupdate] [-CAfile file] [-CApath dir]

DESCRIPTION

       The crl command processes CRL files in DER or PEM format.

COMMAND OPTIONS

       -inform DER|PEM
	   This specifies the input format. DER format is DER encoded CRL structure. PEM (the default) is a base64 encoded version of the DER form
	   with header and footer lines.

       -outform DER|PEM
	   This specifies the output format, the options have the same meaning as the -inform option.

       -in filename
	   This specifies the input filename to read from or standard input if this option is not specified.

       -out filename
	   specifies the output filename to write to or standard output by default.

       -text
	   print out the CRL in text form.

       -noout
	   don't output the encoded version of the CRL.

       -hash
	   output a hash of the issuer name. This can be use to lookup CRLs in a directory by issuer name.

       -issuer
	   output the issuer name.

       -lastupdate
	   output the lastUpdate field.

       -nextupdate
	   output the nextUpdate field.

       -CAfile file
	   verify the signature on a CRL by looking up the issuing certificate in file

       -CApath dir
	   verify the signature on a CRL by looking up the issuing certificate in dir. This directory must be a standard certificate directory:
	   that is a hash of each subject name (using x509 -hash) should be linked to each certificate.

NOTES

       The PEM CRL format uses the header and footer lines:

	-----BEGIN X509 CRL-----
	-----END X509 CRL-----

EXAMPLES

       Convert a CRL file from PEM to DER:

	openssl crl -in crl.pem -outform DER -out crl.der

       Output the text form of a DER encoded certificate:

	openssl crl -in crl.der -text -noout

BUGS

       Ideally it should be possible to create a CRL using appropriate options and files too.

SEE ALSO

       crl2pkcs7(1), ca(1), x509(1)

1.0.0								    2000-02-08								    CRL(1)
Man Page