Comment
Author: Admin | 2025-04-28
On your CA, and on those systems copy it to the required directory or directories for programs that refer to it.Restart any services that use your CA and the CRL file.You can use this process to revoke any certificates that you’ve previously issued at any time. We’ll go over each step in detail in the following sections, starting with the revoke command.Revoking a CertificateTo revoke a certificate, navigate to the easy-rsa directory on your CA server:cd ~/easy-rsaNext, run the easyrsa script with the revoke option, followed by the client name you wish to revoke. Following the practice example above, the Common Name of the certificate is sammy-server:./easyrsa revoke sammy-serverThis will ask you to confirm the revocation by entering yes:OutputPlease confirm you wish to revoke the certificate with the following subject:subject= commonName = sammy-serverType the word 'yes' to continue, or any other input to abort. Continue with revocation: yes. . .Revoking Certificate 8348B3F146A765581946040D5C4D590A. . .Note the highlighted value on the Revoking Certificate line. This value is the unique serial number of the certificate that is being revoked. If you want to examine the revocation list in the last step of this section to verify that the certificate is in it, you’ll need this value.After confirming the action, the CA will revoke the certificate. However, remote systems that rely on the CA have no way to check whether any certificates have been revoked. Users and servers will still be able to use the certificate until the CA’s Certificate Revocation List (CRL) is distributed to all systems that rely on the CA.In the next step you’ll generate a CRL or update an existing crl.pem file.Generating a Certificate Revocation ListNow that you have revoked a certificate, it is important to update the list of revoked certificates on your CA server. Once you have an updated revocation list you will be able to tell which users and systems have valid certificates in your CA.To generate a CRL, run the easy-rsa command with the gen-crl option while still inside the ~/easy-rsa directory:./easyrsa gen-crlIf you have used a passphrase when creating your ca.key file, you will be
Add Comment