1PKI --SIGNCRL(1)                  strongSwan                  PKI --SIGNCRL(1)
2
3
4

NAME

6       pki  --signcrl  -  Issue a Certificate Revocation List (CRL) using a CA
7       certificate and key
8

SYNOPSIS

10       pki --signcrl --cakey file|--cakeyid hex --cacert file
11                     [--lifetime days] [--this-update datetime] [--next-
12                     update datetime] [--lastcrl crl] [--basecrl crl]
13                     [--crluri uri] [--digest digest] [--rsa-padding padding]
14                     [[--reason reason] [--date ts] --cert file|--serial hex]
15                     [--critical oid] [--outform encoding] [--debug level]
16
17       pki --signcrl --options file
18
19       pki --signcrl -h | --help
20

DESCRIPTION

22       This  sub-command  of  pki(1) is used to issue a Certificate Revocation
23       List (CRL) using a CA certificate and private key.
24

OPTIONS

26       -h, --help
27              Print usage information with a summary of the available options.
28
29       -v, --debug level
30              Set debug level, default: 1.
31
32       -+, --options file
33              Read command line options from file.
34
35       -k, --cakey file
36              CA private key file. Either this or --cakeyid is required.
37
38       -x, --cakeyid hex
39              Smartcard or TPM CA private key object handle in hex format with
40              an optional 0x prefix. Either this or --cakey is required.
41
42       -c, --cacert file
43              CA certificate file. Required.
44
45       -l, --lifetime days
46              Days  until  the  CRL gets a nextUpdate, default: 15. Ignored if
47              both an absolute start and end time are given.
48
49       -F, --this-update datetime
50              Absolute time when the validity of the CRL begins. The  datetime
51              format is defined by the --dateform option.
52
53       -T, --next-update datetime
54              Absolute  time  when  the  validity of the CRL end. The datetime
55              format is defined by the --dateform option.
56
57       -D, --dateform form
58              strptime(3) format for the --this-update and  --next-update  op‐
59              tions, default: %d.%m.%y %T
60
61       -a, --lastcrl crl
62              CRL of lastUpdate to copy revocations from.
63
64       -b, --basecrl crl
65              Base CRL to create a delta CRL for.
66
67       -u, --crluri uri
68              Freshest  delta  CRL URI to include in CRL. Can be used multiple
69              times.
70
71       -g, --digest digest
72              Digest to use for signature creation. One of md5, sha1,  sha224,
73              sha256,  sha384,  or sha512.  The default is determined based on
74              the type and size of the signature key.
75
76       -R, --rsa-padding padding
77              Padding to use for RSA signatures. Either pkcs1 or pss, defaults
78              to pkcs1.
79
80       -X, --critical oid
81              Add a critical extension with the given OID.
82
83       -f, --outform encoding
84              Encoding of the created certificate file. Either der (ASN.1 DER)
85              or pem (Base64 PEM), defaults to der.
86
87   Revoked Certificates
88       Multiple revoked certificates can be added to the CRL by either provid‐
89       ing  the  certificate file or the respective serial number directly.  A
90       reason and a timestamp can be configured for each revocation (they have
91       to be given before each certificate/serial on the command line).
92
93       -r, --reason reason
94              The  reason  why the certificate was revoked. One of key-compro‐
95              mise,  ca-compromise,  affiliation-changed,  superseded,  cessa‐
96              tion-of-operation, or certificate-hold.
97
98       -d, --date ts
99              Revocation date as Unix timestamp. Defaults to the current time.
100
101       -z, --cert file
102              Certificate file to revoke.
103
104       -s, --serial hex
105              Hexadecimal encoded serial number of the certificate to revoke.
106

EXAMPLES

108       Revoke a certificate:
109
110         pki --signcrl --cacert ca_cert.der --cakey ca_key.der \
111             --reason superseded --cert cert.der > crl.der
112
113       Update  an  existing  CRL  with two new revocations, using the certifi‐
114       cate's serial number, but no reason:
115
116         pki --signcrl --cacert ca_cert.der --cakey ca_key.der \
117             --lastcrl old_crl.der --serial 0123 --serial 0345 > crl.der
118

SEE ALSO

120       pki(1)
121
122
123
1245.9.4                             2019-05-06                  PKI --SIGNCRL(1)
Impressum