1PKI --SIGNCRL(1)                  strongSwan                  PKI --SIGNCRL(1)
2
3
4

NAME

6       pki  --signcrl  -  Issue a Certificate Revocation List (CRL) using a CA
7       certificate and key
8

SYNOPSIS

10       pki --signcrl --cakey file|--cakeyid hex --cacert file
11                     [--lifetime days] [--this-update datetime] [--next-
12                     update datetime] [--lastcrl crl] [--basecrl crl]
13                     [--crluri uri] [--digest digest]
14                     [[--reason reason] [--date ts] --cert file|--serial hex]
15                     [--outform encoding] [--debug level]
16
17       pki --signcrl --options file
18
19       pki --signcrl -h | --help
20

DESCRIPTION

22       This  sub-command  of  pki(1) is used to issue a Certificate Revocation
23       List (CRL) using a CA certificate and private key.
24

OPTIONS

26       -h, --help
27              Print usage information with a summary of the available options.
28
29       -v, --debug level
30              Set debug level, default: 1.
31
32       -+, --options file
33              Read command line options from file.
34
35       -k, --cakey file
36              CA private key file. Either this or --cakeyid is required.
37
38       -x, --cakeyid hex
39              Key ID of a CA private  key  on  a  smartcard.  Either  this  or
40              --cakey is required.
41
42       -c, --cacert file
43              CA certificate file. Required.
44
45       -l, --lifetime days
46              Days  until  the  CRL gets a nextUpdate, default: 15. Ignored if
47              both an absolute start and end time are given.
48
49       -F, --this-update datetime
50              Absolute time when the validity of the CRL begins. The  datetime
51              format is defined by the --dateform option.
52
53       -T, --next-update datetime
54              Absolute  time  when  the  validity of the CRL end. The datetime
55              format is defined by the --dateform option.
56
57       -D, --dateform form
58              strptime(3)  format  for  the  --this-update  and  --next-update
59              options, default: %d.%m.%y %T
60
61       -a, --lastcrl crl
62              CRL of lastUpdate to copy revocations from.
63
64       -b, --basecrl crl
65              Base CRL to create a delta CRL for.
66
67       -u, --crluri uri
68              Freshest  delta  CRL URI to include in CRL. Can be used multiple
69              times.
70
71       -g, --digest digest
72              Digest to use for signature creation. One of md5, sha1,  sha224,
73              sha256, sha384, or sha512. Defaults to sha1.
74
75       -f, --outform encoding
76              Encoding of the created certificate file. Either der (ASN.1 DER)
77              or pem (Base64 PEM), defaults to der.
78
79   Revoked Certificates
80       Multiple revoked certificates can be added to the CRL by either provid‐
81       ing  the  certificate file or the respective serial number directly.  A
82       reason and a timestamp can be configured for each revocation (they have
83       to be given before each certificate/serial on the command line).
84
85       -r, --reason reason
86              The  reason  why the certificate was revoked. One of key-compro‐
87              mise,  ca-compromise,  affiliation-changed,  superseded,  cessa‐
88              tion-of-operation, or certificate-hold.
89
90       -d, --date ts
91              Revocation date as Unix timestamp. Defaults to the current time.
92
93       -z, --cert file
94              Certificate file to revoke.
95
96       -s, --serial hex
97              Hexadecimal encoded serial number of the certificate to revoke.
98

EXAMPLES

100       Revoke a certificate:
101
102         pki --signcrl --cacert ca_cert.der --cakey ca_key.der \
103             --reason superseded --cert cert.der > crl.der
104
105       Update  an  existing  CRL  with two new revocations, using the certifi‐
106       cate's serial number, but no reason:
107
108         pki --signcrl --cacert ca_cert.der --cakey ca_key.der \
109             --lastcrl old_crl.der --serial 0123 --serial 0345 > crl.der
110

SEE ALSO

112       pki(1)
113
114
115
1165.2.0                             2013-08-12                  PKI --SIGNCRL(1)
Impressum