While revocation toggling is a not so good practice at all, there is some special case where unrevoking a key (like an undo) could be usefull.
Worst: A crt could never be deleted instead of very specific cases, like studying. At end of this, you may see how I delete the last index entry (as an undo action).
unrevoke
There is a little unrevoke
script I wrote.
As this is not a standard feature, I've added a kind of log file, called unrevoke.txt
, in ASCII format and reusing the structure of index.txt (tab separated):
U | Revocation date | Unrevocation date | Id | unknown | Subject
Warn: It work for my need, but you have to test them before regular use!
#!/bin/bash
# un-revoke a certificate, regenerate CRL,
# and verify revocation status
CRL=crl.pem
if test $# -ne 1; then
echo "usage: unrevoke <name|idx>";
exit 1
fi
if test $KEY_DIR; then
cd $KEY_DIR
read issuer < <(openssl x509 -issuer -noout -in $KEY_DIR/ca.crt)
issuer=${issuer#*CN=}
issuer=${issuer%%/*}
export KEY_CN=$issuer KEY_OU=$issuer KEY_NAME=$issuer
if [ -f $1.crt ] ;then
NAM=$1
REV=($(sed -ne <index.txt "s/^R\t[^\t]*\t\([0-9]\+Z\)\t\([0-9A-F]\{2,8\}\)\tunknown\t\(.*CN=$1\/.*\)$/\1 \2 \3/p"))
IDX=${REV[1]}
SUB="${REV[@]:2}"
else
if [ -f $1.pem ] ;then
IDX=$1
REV=($(sed -ne <index.txt "s/^R\t[^\t]*\t\([0-9]\+Z\)\t$1\tunknown\t\(.*CN=\([^\/]\+\)\/.*\)$/\1 \3 \2/p"))
NAM=${REV[1]}
SUB="${REV[@]:2}"
fi
fi
CRT=$IDX.pem
if [ -f $CRT ] && [ "$NAM" ] && [ "$IDX" ] ;then
printf "Key idx: %s, name: %s\n" $IDX $NAM
else
echo Key $1 not found.
exit 1
fi
DTE=$(date +"%y%m%d%H%M%SZ")
# unrevoke key
sed -e "s/^R\t\([0-9]\+Z\)\t[0-9]\+Z\t$IDX\t/V\t\1\t\t$IDX\t/" -i.old index.txt &&
printf "U\t%s\t%s\t%s\tunknown\t%s\n" $REV $DTE $IDX "$SUB" >>unrevoke.txt
# generate a new CRL
openssl ca -gencrl -out $CRL -config $KEY_CONFIG
# verify the revocation
openssl verify -CAfile <(cat ca.crt $CRL) -crl_check $CRT
else
echo you must define KEY_DIR
fi
delete-last
For info only!!: key as to NEVER be deleted in order to permit his revocation!
#!/bin/bash
# For info only!!
# key as to NEVER be deleted
# for making a correct revocation liste
#
# Don't use it unless you're sure you know what you're doing!!!
cd $KEY_DIR || exit 1
mapfile index <index.txt
OIFS="$IFS"
IFS=$'\t'
line=(${index[${#index[@]}-1]})
IFS="$OIFS"
if [ "$line" == "V" ] ;then
idx=${line[2]}
nam=${line[4]#*CN=}
else
idx=${line[3]}
nam=${line[5]#*CN=}
fi
nam=${nam%%/*}
rm -v $nam.* $idx.*
unset index[${#index[@]}-1]
cat index.txt >index.txt.old
printf "%s" "${index[@]}" >index.txt
cat serial >serial.old
echo ${line[2]} >serial