Your title is misleading; you are using the default config file, just fine, as shown in your first line of output.
How do I revoke the certificate and generate a CRL?
These are two separate steps with OpenSSL.
First use openssl ca -revoke $certfile
much as you did, but if you want to specify a reason (you don't need to) you must use a flag like -crl_reason superseded
not just superseded
. This step only updates the 'database' (a simple text file normally named index.txt
although it can be configured otherwise). If the CA key and cert files are specified in the config file, which they normally should be, you don't need to specify them on the command line. (This operation doesn't really need them but does access them; see Why does OpenSSL need the private key to revoke a certificate? )
Anytime after the 'database' is updated, use openssl ca -gencrl [options]
to actually generate a CRL from the current (updated) contents. The CRL period (in days, hours, or seconds) must be specified on the command line or in the config file; the upstream default config sets it to 30 days, but I don't know what packaging or other modification you are using. Other options may be added as per the man page. This operation does need the CA key and cert, because the CRL is signed with that key and marked for verification with that cert.
This 'database' scheme is identified, rather briefly, in the first text paragraph of the man page for ca(1ssl?)
on a Unixy system with OpenSSL or on the web:
The ca command is a minimal CA application. It can be used to sign certificate requests in a variety of forms and generate CRLs it also maintains a text database of issued certificates and their status.
The 'text database' is the index.txt file (normally) and 'status [of issued certs]' is whether, when and why they were revoked. Whether is indicated by the first tabdelimited field being V for valid or R for revoked; the other information is in the third field and should be pretty obvious.