I created a self-signed CA certificate, and then created a client certificate using this tutorial here. I am just trying to revoke the client certificate:

openssl ca -keyfile rootCA.key -cert rootCA.crt  -revoke ../oldCert/old.pem superseded

When I try, I get this error:

Using configuration from /etc/ssl/openssl.cnf
unable to load certificate
140187823251392:error:0906D06C:PEM routines:PEM_read_bio:no start line:crypto/pem/pem_lib.c:691:Expecting: TRUSTED CERTIFICATE

I've tried pretty much everything there is on the internet, but it just results in the same error. How do I revoke the certificate and generate a CRL?

  • 3
    "I've tried pretty much everything there is on the internet..." - this statement does not help at all since it does not describe what you really tried and how exactly you failed. And, it was probably not "everything there is on the internet" but rather everything you could find within some (short?) time, could kind of understand and found useful to try - which is very different. Sep 17, 2017 at 5:19

2 Answers 2


Your title is misleading; you are using the default config file, just fine, as shown in your first line of output.

How do I revoke the certificate and generate a CRL?

These are two separate steps with OpenSSL.

First use openssl ca -revoke $certfile much as you did, but if you want to specify a reason (you don't need to) you must use a flag like -crl_reason superseded not just superseded. This step only updates the 'database' (a simple text file normally named index.txt although it can be configured otherwise). If the CA key and cert files are specified in the config file, which they normally should be, you don't need to specify them on the command line. (This operation doesn't really need them but does access them; see Why does OpenSSL need the private key to revoke a certificate? )

Anytime after the 'database' is updated, use openssl ca -gencrl [options] to actually generate a CRL from the current (updated) contents. The CRL period (in days, hours, or seconds) must be specified on the command line or in the config file; the upstream default config sets it to 30 days, but I don't know what packaging or other modification you are using. Other options may be added as per the man page. This operation does need the CA key and cert, because the CRL is signed with that key and marked for verification with that cert.

This 'database' scheme is identified, rather briefly, in the first text paragraph of the man page for ca(1ssl?) on a Unixy system with OpenSSL or on the web:

The ca command is a minimal CA application. It can be used to sign certificate requests in a variety of forms and generate CRLs it also maintains a text database of issued certificates and their status.

The 'text database' is the index.txt file (normally) and 'status [of issued certs]' is whether, when and why they were revoked. Whether is indicated by the first tabdelimited field being V for valid or R for revoked; the other information is in the third field and should be pretty obvious.

  • I still get the PEM routines:PEM_read_bio:no start line:crypto/pem/pem_lib.c:691:Expecting: TRUSTED CERTIFICATE error. My command that I am using is openssl ca -keyfile rootCA.key -cert rootCA.crt -revoke ../oldCert/oldCert.pem -crl_reason superseded. Any ideas?
    – etnguyen03
    Sep 17, 2017 at 11:11
  • @etnguyen03: make sure each of the files that should contain a cert (rootCA.crt and oldCert.pem) in fact contains a cert in PEM format. If they look okay, feed each separately to openssl x509 -in $file and see if that complains. Sep 18, 2017 at 5:36

The revocation command uses the path taken from the /etc/ssl/openssl.cnf file, instead of your command, so it actually looks for certs in the cert/ directory.

Move them manually to this folder and it should work.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.