misc updates

[vpn-prov.git] / easy-rsa / revoke-full

#!/bin/sh

# revoke a certificate, regenerate CRL,
# and verify revocation

CRL="crl.pem"
RT="revoke-test.pem"

if [ $# -ne 1 ]; then
    echo "usage: revoke-full <cert-name-base>";
    exit 1
fi

if [ "$KEY_DIR" ]; then
    cd "$KEY_DIR"
    rm -f "$RT"

    # set defaults
    export KEY_CN=""
    export KEY_OU=""
    export KEY_NAME=""

    # revoke key and generate a new CRL
    if [ -f "$1.crt" ]; then
        crtname="$1.crt"
    elif [ -f "$1.pem" ]; then
        crtname="$1.pem"
    else
        echo "That certificate doesn't exist ($1.crt or $1.pem)"
        exit
    fi
    $OPENSSL ca -revoke "$crtname" -config "$KEY_CONFIG"

    # generate a new CRL -- try to be compatible with
    # intermediate PKIs
    $OPENSSL ca -gencrl -out "$CRL" -config "$KEY_CONFIG"
    if [ -e export-ca.crt ]; then
        cat export-ca.crt "$CRL" >"$RT"
    else
        cat ca.crt "$CRL" >"$RT"
    fi

    # verify the revocation
    $OPENSSL verify -CAfile "$RT" -crl_check "$crtname"
else
    echo 'Please source the vars script first (i.e. "source ./vars")'
    echo 'Make sure you have edited it to reflect your configuration.'
fi