Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

openssl ca -revoke signed/0A.pem -config caconfig.cnf

What does this do which requires the CA's private key? Does it do anything except updating index.txt?

share|improve this question
up vote 9 down vote accepted

It is a bug of OpenSSL (at least in version 1.0.1c); precisely, a bug of the command-line "ca" option handling. If you look at the apps/ca.c source file in OpenSSL source code, you may see that the MAIN() function begins by parsing the command-line options, then reads the configuration file, then does this:

    /* report status of cert with serial number given on command line */
    if (ser_status)
         /* some stuff */
         goto err;

    /* we definitely need a private key, so let's get it */

    if ((keyfile == NULL) && ((keyfile=NCONF_get_string(conf,
            section,ENV_PRIVATE_KEY)) == NULL))
            goto err;
    if (!key)
            free_key = 1;
            if (!app_passwd(bio_err, passargin, NULL, &key, NULL))
                    BIO_printf(bio_err,"Error getting password\n");
                    goto err;
    pkey = load_key(bio_err, keyfile, keyform, 0, key, e,
            "CA private key");

Which means that the code will recognize the special case of checking on the revocation status of a certificate (command-line option -status), which of course does not need the CA private key, but will otherwise insist on loading the CA private key, whether it will be actually needed or not.

In particular, revoking a certificate, in the context of this tool, means marking it as revoked in the index.txt "database" of issued certificate, which does not use the CA private key. What uses the CA private key is signing the CRL (which informs the rest of the world that the certificate is really revoked), but the -revoke command-line option does not trigger that (it is the -gencrl option which implies issuance of a new CRL).

Summary: "openssl ca -revoke" implies reading the CA private key for no good reason at all. Feel free to patch the tool from its source code, and possibly submit the patch to the OpenSSL maintainers.

share|improve this answer
how interesting... – Evan Carroll Jul 29 '13 at 18:57

The private key of the CA is needed because the revocation must be signed by the CA. Else it would be possible that the revocation is done by any entity.

share|improve this answer
I believe you are wrong (but I'm not shure). When i generate my CRL after revoking certificates, i do not see any difference between certificates that are revoked with the above command and certificates that are revoked by editing index.txt in a text editor. What do you mean is is signed when using the above command? – Stian Fauskanger Jul 4 '13 at 10:54
The CA private key is needed to generate the CRL (which is what @Uwe says) but the "-revoke" option does not imply a CRL generation; it just marks the certificate as "to be included in the next CRL, whenever this happens". – Tom Leek Jul 4 '13 at 14:50

Uwe Plonus is right. The CA always provides a revocation-list (CRL) in wich all revoked certificates are listed by their serial number and other information like the datetime when a crt was revoked.

See for further information.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.