PKI---SIGNCRL(1)

💅 PKI--SIGNCRL(1) — bestie's guide to strongSwan

okay so this is the pki --signcrl page from the strongSwan manual, and we're gonna get into it 💖

---

✨ NAME ✨

pki --signcrl — Issue a Certificate Revocation List (CRL) using a CA certificate and key 🎀

✨ SYNOPSIS ✨

pki --signcrl --cakey file|--cakeyid hex --cacert file [--lifetime days]
              [--this-update datetime] [--next-update datetime]
              [--lastcrl crl] [--basecrl crl] [--crluri uri]
              [--digest digest] [--rsa-padding padding]
              [[--reason reason] [--date ts] --cert file|--serial hex]
              [--critical oid] [--outform encoding] [--debug level]

pki --signcrl --options file

pki --signcrl -h | --help

✨ DESCRIPTION ✨

so this is a sub-command of pki(1) 👑 and what it does is issue a Certificate Revocation List (CRL) using a CA certificate and private key. that's it. that's the whole vibe. it's giving "official hater energy, but for certs" 💅

✨ OPTIONS ✨

• -h, --help — prints the usage info plus a summary of all the options available 🫶
• -v, --debug level — sets the debug level, default is 1 🐛
• -+, --options file — reads the command line options from a file, yep, you can just stick 'em in a file 📄
• -k, --cakey file — the CA private key file. you need either this one or --cakeyid, no skipping 🔑
• -x, --cakeyid hex — the smartcard or TPM CA private key object handle, in hex format, with an optional 0x prefix. either this or --cakey is required 💳
• -c, --cacert file — the CA certificate file. Required. fr fr, you gotta have it ⭐
• -l, --lifetime days — how many days until the CRL gets a nextUpdate, default is 15. it gets ignored if you give both an absolute start and end time 🗓️
• -F, --this-update datetime — the absolute time when the validity of the CRL begins. the datetime format is defined by the --dateform option ⏰
• -T, --next-update datetime — the absolute time when the validity of the CRL end. the datetime format is defined by the --dateform option ⏳
• -D, --dateform form — the strptime(3) format used for the --this-update and --next-update options, default is %d.%m.%y %T 📅
• -a, --lastcrl crl — a CRL of lastUpdate to copy revocations from. recycling era ♻️
• -b, --basecrl crl — a base CRL to create a delta CRL for 🧬
• -u, --crluri uri — the freshest delta CRL URI to include in the CRL. can be used multiple times, stack 'em 🌈
• -g, --digest digest — the digest to use for signature creation. one of md5, sha1, sha224, sha256, sha384, or sha512. the default is determined based on the type and size of the signature key 🔐
• -R, --rsa-padding padding — the padding to use for RSA signatures. either pkcs1 or pss, defaults to pkcs1 🧸
• -X, --critical oid — adds a critical extension with the given OID 📌
• -f, --outform encoding — the encoding of the created certificate file. either der (ASN.1 DER) or pem (Base64 PEM), defaults to der 🎁

🦋 Revoked Certificates 🦋

you can add multiple revoked certificates to the CRL, and you do it by either handing over the certificate file or the respective serial number directly. a reason and a timestamp can be configured for each revocation — and heads up, they have to be given before each certificate/serial on the command line ⚠️

• -r, --reason reason — the reason why the certificate was revoked. one of key-compromise, ca-compromise, affiliation-changed, superseded, cessation-of-operation, or certificate-hold 💀
• -d, --date ts — the revocation date as a Unix timestamp. defaults to the current time 🕐
• -z, --cert file — the certificate file to revoke 📜
• -s, --serial hex — the hexadecimal encoded serial number of the certificate to revoke 🔢

✨ EXAMPLES ✨

revoke a certificate, iconic behaviour:

pki --signcrl --cacert ca_cert.der --cakey ca_key.der \
    --reason superseded --cert cert.der > crl.der

update an existing CRL with two new revocations, using the certificate's serial number, but no reason:

pki --signcrl --cacert ca_cert.der --cakey ca_key.der \
    --lastcrl old_crl.der --serial 0123 --serial 0345 > crl.der

✨ SEE ALSO ✨

pki(1) — go read that one too bestie 🫶

---

ngl if you're messing with --critical oid or --rsa-padding, double-check what you're doing first, 'cause it's all literally going into a signed CRL ✨

---

🌸 that's the whole page! brought to you by strongSwan, version 6.1.0, dated 2019-05-06 — mwah, go sign some CRLs responsibly 💜🎀