There is no method to "unsuspend" a certificate in openssl on the CLI that I am aware of. And the following quote may give you a bit more guidance:
Martin Abalea, OpenSSL mailing list, 2008-10-13, Re: Put certificate on hold:
Reading the X.509 recommendation (downloadable for free from the ITU-T
web site) tells us that a certificate can be "un-holded" by 2 means:
- either really revoke it, by changing the reason code while keeping the date
- or completely remove it from the CRL, as you guessed.
Again, I am not aware of any CLI commands for OpenSSL so your options may be:
- issue a new cert or
restore a copy of the CA DB prior to the revocation and issue a new CRL.
If you have other revoked certs, you want to make sure you jot them down if you restore your DB. Otherwise, you stated this is your private CA, I don't see why generating a new CERT is an issue.
There is yet a "long shot" method you may be able to using Microsoft (don't know how to do something similar in OpenSSL).
If you can import your cert into the MS CA, MS has an easy "right click" to unrevoke. See the following documentation on how to do this. Here is the CLI from that page:
To unrevoke a certificate revoked with the reason code "Certificate
Hold," at a command prompt on the CA, type:
certutil -revoke CertificateSerialNumber unrevoke