Add a revoked cert to the sample keys

Allows for easier testing of the revocation functionality.

---
 sample/sample-keys/gen-sample-keys.sh | 9 +++++++++
 1 file changed, 9 insertions(+)

index 725cfc9..301cff2 100755
@@ -52,6 +52,14 @@ openssl pkcs12 -export -nodes -password pass:password \
     -out sample-ca/client.p12 -inkey sample-ca/client.key \
     -in sample-ca/client.crt -certfile sample-ca/ca.crt
 
+# Create a client cert, revoke it, generate CRL
+openssl req -new -nodes -config openssl.cnf \
+    -keyout sample-ca/client-revoked.key -out sample-ca/client-revoked.csr \
+    -subj "/C=KG/ST=NA/O=OpenVPN-TEST/CN=client-revoked/[email protected]..."
+openssl ca -batch -config openssl.cnf \
+    -out sample-ca/client-revoked.crt -in sample-ca/client-revoked.csr
+openssl ca -config openssl.cnf -revoke sample-ca/client-revoked.crt
+openssl ca -config openssl.cnf -gencrl -out sample-ca/ca.crl
 
 # Create EC server and client cert (signed by 'regular' RSA CA)
 openssl ecparam -out sample-ca/secp256k1.pem -name secp256k1

@@ -76,3 +84,4 @@ openssl dhparam -out dh2048.pem 2048
 cp sample-ca/*.key .
 cp sample-ca/*.crt .
 cp sample-ca/*.p12 .
+cp sample-ca/*.crl .

2.7.4

ACK. Great idea to test stuff and if it is only as a documentation example (aka look in the script how to revoke)

Am 26.10.16 um 21:29 schrieb Steffan Karger:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Your patch has been applied to the dev/pre-push-hook branch

commit a64d76e246042fde40189033b87b126627db5b6b

Author: Steffan Karger
Date:   Wed Oct 26 21:29:19 2016 +0200

     Add a revoked cert to the sample keys

     Signed-off-by: Steffan Karger <[email protected]...>
     Acked-by: Arne Schwabe <[email protected]...>
     Message-Id: <[email protected]...>
     URL: https://www.mail-archive.com/[email protected]/msg12784.html
     Signed-off-by: David Sommerseth <[email protected]...>

- --
kind regards,

David Sommerseth

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)

iQIcBAEBAgAGBQJYE09/AAoJEIbPlEyWcf3y1NgP/2Gapmp1r18wkkKQCY0D35uJ YEDQskAsW47hH5cq+bFvNNu64HZcMXi72idAOFwFLAzZQxQoPa/wwk2Snyo7HBEB YdN7PQkSnM7tTDUj8jJaZAMrjYOiZcLpsGf51t+wl0o0wjK7uZzhqLWUJU92szTR MuBdXmFXJ23D6gqfzNqefmU6G2W4FHFl4e62QTIi0SWswGfKJfs+Wt5Acpo9xlZi sGBAeI/p7I5M9+7gwbHFXiSZh5IPA7sQcptfPtv0K7E/64NNlS1GlWGw4+DLFBfM 59AGsmd9XR3X9+n8z1nrbb/cveA/Iq+PnXr1oeYyZta+809nMqtcnbr9PU9riyJu sn1q5XGOeHuM99Va4CnKtOsbP6/7bByY9cE520IWuM9p3CZrEWPY9aRIuKZUzf2m JrHKI0+bzD9NG1pvAY101Yw6OqWUzz14kt5NGRkXI76NNvHsBBJ3fpFz2evZRl3q bnYCM/6cVrRpWHY7NxJQX6Kg6GmqnMUQBqxHQlfEZHVr3sx2qB/EvKtfRbzmvfJD luGT6y6B86tXwGDub+aji5cdaMV3rtP+rqdKpbqVERu9svQ7LaMG6eFvuOab+cOr Qh4FN5Fsggfk0udBUPG6eZKCbVh5QvINsXboySIlpx6OutUNVY5xG67iKnBocOdu fLTAlfltknooNAu0Vjfu
=PnH/
-----END PGP SIGNATURE-----

That should be the master branch. My scripts obviously needs some more enhancements.

kind regards,

David Sommerseth