STRONGSWAN_PKI---SIGNCRL(1)

💅 pki --signcrl — bestie's guide to the PKI --SIGNCRL(1) page ✨

okay so. you want to issue a Certificate Revocation List (CRL) using a CA certificate and key?? say less. this is the pki --signcrl sub-command, and it's giving main character energy, no cap. strongSwan girlies rise 🫶

---

🌸 SYNOPSIS 🌸

pki --signcrl --cakey file|--cakeyid hex --cacert file [--lifetime days]
              [--this-update datetime] [--next-update datetime]
              [--lastcrl crl] [--basecrl crl] [--crluri uri]
              [--digest digest] [--rsa-padding padding]
              [[--reason reason] [--date ts] --cert file|--serial hex]
              [--critical oid] [--outform encoding] [--debug level]

pki --signcrl --options file

pki --signcrl -h | --help

---

🦋 DESCRIPTION 🦋

so basically, this sub-command of pki(1) is here to issue a Certificate Revocation List (CRL) using a CA certificate and private key. that's the whole vibe. iconic honestly. 💖

---

✨ OPTIONS ✨

okay bestie, buckle up, there's a lot, and every single one of them matters, so don't skip:

• -h, --help — prints usage info with a lil summary of all the available options. the "help me help you" flag 🎀
• -v, --debug level — sets the debug level, default: 1. turn it up when things are acting mysterious 💀
• -+, --options file — reads command line options from file. your options, but in a file, lowkey convenient ✨
• -k, --cakey file — CA private key file. you need either this or --cakeyid. pick one, bestie, not both 🫶
• -x, --cakeyid hex — Smartcard or TPM CA private key object handle in hex format, with an optional 0x prefix. either this or --cakey is required. fancy hardware girlies, this one's for you 💅
• -c, --cacert file — CA certificate file. Required. like, actually required. no skipping 🙈
• -l, --lifetime days — days until the CRL gets a nextUpdate, default: 15. it gets ignored if you give both an absolute start and end time. sorry not sorry ⭐
• -F, --this-update datetime — absolute time when the validity of the CRL begins. the datetime format is defined by the --dateform option 🕐
• -T, --next-update datetime — absolute time when the validity of the CRL end. the datetime format is defined by the --dateform option 🌈
• -D, --dateform form — the strptime(3) format used for the --this-update and --next-update options, default: %d.%m.%y %T 🗓️
• -a, --lastcrl crl — a CRL of lastUpdate to copy revocations from. hand me downs but make it cryptographic 💜
• -b, --basecrl crl — base CRL to create a delta CRL for. delta girlie behavior 🧚
• -u, --crluri uri — freshest delta CRL URI to include in the CRL. can be used multiple times, so go off 🔥
• -g, --digest digest — digest to use for signature creation. one of md5, sha1, sha224, sha256, sha384, or sha512. the default is determined based on the type and size of the signature key 🌸
• -R, --rsa-padding padding — padding to use for RSA signatures. either pkcs1 or pss, defaults to pkcs1 💖
• -X, --critical oid — add a critical extension with the given OID. critical = it means business, don't ignore it 👑
• -f, --outform encoding — encoding of the created certificate file. either der (ASN.1 DER) or pem (Base64 PEM), defaults to der ✨

---

🎀 Revoked Certificates 🎀

you can add multiple revoked certificates to the CRL, either by handing over the certificate file or the respective serial number directly. a reason and a timestamp can be configured for each revocation — and listen, they have to be given before each certificate/serial on the command line. order matters, bestie, it's giving choreography 💅

• -r, --reason reason — the reason why the certificate was revoked. one of key-compromise, ca-compromise, affiliation-changed, superseded, cessation-of-operation, or certificate-hold. spill the tea, why'd they get revoked 😭
• -d, --date ts — revocation date as Unix timestamp. defaults to the current time 🕐
• -z, --cert file — certificate file to revoke 📄
• -s, --serial hex — hexadecimal encoded serial number of the certificate to revoke 🔢

---

🌟 EXAMPLES 🌟

revoke a certificate, easy peasy:

pki --signcrl --cacert ca_cert.der --cakey ca_key.der \
    --reason superseded --cert cert.der > crl.der

update an existing CRL with two new revocations, using the certificate's serial number, but no reason (minimalist queen):

pki --signcrl --cacert ca_cert.der --cakey ca_key.der \
    --lastcrl old_crl.der --serial 0123 --serial 0345 > crl.der

---

👀 SEE ALSO 👀

• pki(1) — the mothership, go read it fr fr

---

and that's the whole page, bestie, you ate that 💖 this was strongSwan 6.0.7, dated 2019-05-06, and the vibe check is passed. periodt. 🎀✨🦋