1PKI --SIGNCRL(1) strongSwan PKI --SIGNCRL(1)
2
6 pki --signcrl - Issue a Certificate Revocation List (CRL) using a CA
7 certificate and key
8
10 pki --signcrl --cakey file|--cakeyid hex --cacert file
11 [--lifetime days] [--this-update datetime] [--next-
12 update datetime] [--lastcrl crl] [--basecrl crl]
13 [--crluri uri] [--digest digest] [--rsa-padding padding]
14 [[--reason reason] [--date ts] --cert file|--serial hex]
15 [--critical oid] [--outform encoding] [--debug level]
16 pki --signcrl --options file
18 pki --signcrl -h | --help
20
22 This sub-command of pki(1) is used to issue a Certificate Revocation
23 List (CRL) using a CA certificate and private key.
24
26 -h, --help
27 Print usage information with a summary of the available options.
28 -v, --debug level
30 Set debug level, default: 1.
31 -+, --options file
33 Read command line options from file.
34 -k, --cakey file
36 CA private key file. Either this or --cakeyid is required.
37 -x, --cakeyid hex
39 Smartcard or TPM CA private key object handle in hex format with
40 an optional 0x prefix. Either this or --cakey is required.
41 -c, --cacert file
43 CA certificate file. Required.
44 -l, --lifetime days
46 Days until the CRL gets a nextUpdate, default: 15. Ignored if
47 both an absolute start and end time are given.
48 -F, --this-update datetime
50 Absolute time when the validity of the CRL begins. The datetime
51 format is defined by the --dateform option.
52 -T, --next-update datetime
54 Absolute time when the validity of the CRL end. The datetime
55 format is defined by the --dateform option.
56 -D, --dateform form
58 strptime(3) format for the --this-update and --next-update
59 options, default: %d.%m.%y %T
60 -a, --lastcrl crl
62 CRL of lastUpdate to copy revocations from.
63 -b, --basecrl crl
65 Base CRL to create a delta CRL for.
66 -u, --crluri uri
68 Freshest delta CRL URI to include in CRL. Can be used multiple
69 times.
70 -g, --digest digest
72 Digest to use for signature creation. One of md5, sha1, sha224,
73 sha256, sha384, or sha512. The default is determined based on
74 the type and size of the signature key.
75 -R, --rsa-padding padding
77 Padding to use for RSA signatures. Either pkcs1 or pss, defaults
78 to pkcs1.
79 -X, --critical oid
81 Add a critical extension with the given OID.
82 -f, --outform encoding
84 Encoding of the created certificate file. Either der (ASN.1 DER)
85 or pem (Base64 PEM), defaults to der.
86 Revoked Certificates
88 Multiple revoked certificates can be added to the CRL by either provid‐
89 ing the certificate file or the respective serial number directly. A
90 reason and a timestamp can be configured for each revocation (they have
91 to be given before each certificate/serial on the command line).
92 -r, --reason reason
94 The reason why the certificate was revoked. One of key-compro‐
95 mise, ca-compromise, affiliation-changed, superseded, cessa‐
96 tion-of-operation, or certificate-hold.
97 -d, --date ts
99 Revocation date as Unix timestamp. Defaults to the current time.
100 -z, --cert file
102 Certificate file to revoke.
103 -s, --serial hex
105 Hexadecimal encoded serial number of the certificate to revoke.
106
108 Revoke a certificate:
109 pki --signcrl --cacert ca_cert.der --cakey ca_key.der \
111 --reason superseded --cert cert.der > crl.der
112 Update an existing CRL with two new revocations, using the certifi‐
114 cate's serial number, but no reason:
115 pki --signcrl --cacert ca_cert.der --cakey ca_key.der \
117 --lastcrl old_crl.der --serial 0123 --serial 0345 > crl.der
118
120 pki(1)
1215.8.4 2019-05-06 PKI --SIGNCRL(1)