How do I revoke the certificate and generate a CRL?

Question

I created a self-signed CA certificate, and then created a client certificate using this tutorial here. I am just trying to revoke the client certificate:

openssl ca -keyfile rootCA.key -cert rootCA.crt  -revoke ../oldCert/old.pem superseded

When I try, I get this error:

Using configuration from /etc/ssl/openssl.cnf
unable to load certificate
140187823251392:error:0906D06C:PEM routines:PEM_read_bio:no start line:crypto/pem/pem_lib.c:691:Expecting: TRUSTED CERTIFICATE

I've tried pretty much everything there is on the internet, but it just results in the same error. How do I revoke the certificate and generate a CRL?

Answer 1

Your title is misleading; you are using the default config file, just fine, as shown in your first line of output.

How do I revoke the certificate and generate a CRL?

These are two separate steps with OpenSSL.

First use openssl ca -revoke $certfile much as you did, but if you want to specify a reason (you don't need to) you must use a flag like -crl_reason superseded not just superseded. This step only updates the 'database' (a simple text file normally named index.txt although it can be configured otherwise). If the CA key and cert files are specified in the config file, which they normally should be, you don't need to specify them on the command line. (This operation doesn't really need them but does access them; see Why does OpenSSL need the private key to revoke a certificate? )

Anytime after the 'database' is updated, use openssl ca -gencrl [options] to actually generate a CRL from the current (updated) contents. The CRL period (in days, hours, or seconds) must be specified on the command line or in the config file; the upstream default config sets it to 30 days, but I don't know what packaging or other modification you are using. Other options may be added as per the man page. This operation does need the CA key and cert, because the CRL is signed with that key and marked for verification with that cert.

This 'database' scheme is identified, rather briefly, in the first text paragraph of the man page for ca(1ssl?) on a Unixy system with OpenSSL or on the web:

The ca command is a minimal CA application. It can be used to sign certificate requests in a variety of forms and generate CRLs it also maintains a text database of issued certificates and their status.

The 'text database' is the index.txt file (normally) and 'status [of issued certs]' is whether, when and why they were revoked. Whether is indicated by the first tabdelimited field being V for valid or R for revoked; the other information is in the third field and should be pretty obvious.

Answer 2

The revocation command uses the path taken from the /etc/ssl/openssl.cnf file, instead of your command, so it actually looks for certs in the cert/ directory.

Move them manually to this folder and it should work.