openssl ca -revoke signed/0A.pem -config caconfig.cnf

What does this do which requires the CA's private key? Does it do anything except updating index.txt?


It is a bug of OpenSSL (at least in version 1.0.1c); precisely, a bug of the command-line "ca" option handling. If you look at the apps/ca.c source file in OpenSSL source code, you may see that the MAIN() function begins by parsing the command-line options, then reads the configuration file, then does this:

    /* report status of cert with serial number given on command line */
    if (ser_status)
         /* some stuff */
         goto err;

    /* we definitely need a private key, so let's get it */

    if ((keyfile == NULL) && ((keyfile=NCONF_get_string(conf,
            section,ENV_PRIVATE_KEY)) == NULL))
            goto err;
    if (!key)
            free_key = 1;
            if (!app_passwd(bio_err, passargin, NULL, &key, NULL))
                    BIO_printf(bio_err,"Error getting password\n");
                    goto err;
    pkey = load_key(bio_err, keyfile, keyform, 0, key, e,
            "CA private key");

Which means that the code will recognize the special case of checking on the revocation status of a certificate (command-line option -status), which of course does not need the CA private key, but will otherwise insist on loading the CA private key, whether it will be actually needed or not.

In particular, revoking a certificate, in the context of this tool, means marking it as revoked in the index.txt "database" of issued certificate, which does not use the CA private key. What uses the CA private key is signing the CRL (which informs the rest of the world that the certificate is really revoked), but the -revoke command-line option does not trigger that (it is the -gencrl option which implies issuance of a new CRL).

Summary: "openssl ca -revoke" implies reading the CA private key for no good reason at all. Feel free to patch the tool from its source code, and possibly submit the patch to the OpenSSL maintainers.


The private key of the CA is needed because the revocation must be signed by the CA. Else it would be possible that the revocation is done by any entity.

  • I believe you are wrong (but I'm not shure). When i generate my CRL after revoking certificates, i do not see any difference between certificates that are revoked with the above command and certificates that are revoked by editing index.txt in a text editor. What do you mean is is signed when using the above command? – Stian Fauskanger Jul 4 '13 at 10:54
  • 2
    The CA private key is needed to generate the CRL (which is what @Uwe says) but the "-revoke" option does not imply a CRL generation; it just marks the certificate as "to be included in the next CRL, whenever this happens". – Tom Leek Jul 4 '13 at 14:50

Uwe Plonus is right. The CA always provides a revocation-list (CRL) in wich all revoked certificates are listed by their serial number and other information like the datetime when a crt was revoked.

See http://www.openssl.org/docs/apps/crl.html# for further information.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.