Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

To revoke the access to a client, I can do

$./revoke-full client_name

And then place the new crl.pem in the server.

But, how do I re-enable that client? Removing the crl.pem file is not a solution because this will break easy-keys directory and I won't be able to revoke them again, later.

share|improve this question

2 Answers 2

up vote 3 down vote accepted

Certificates should never be unrevoked! You should generate a new one, and give it to the client.

...but still, if you wish:

in your CA folder, there should be an index.txt, with certificate IDs in it. The ones starting with "V" are valid, and ones with "R" are revoked. You can edit that file, and fix the first char to "V", and delete the third column (the revocation date). If you have more then one certificate, you should see the pattern (sequential number comes in the third column now, etc).

Then you just need to regenerate the CRL again, and it should work.

This is an ugly hack,... I still recommend generating a new cert for the client.

share|improve this answer
    
How do I regenerate the CRL? –  shadyabhi Jun 21 '12 at 10:50
    
first source your .vars (same as when doing anything with easy-rsa). Then try: 'openssl ca -gencrl -out "crl.pem" -config "$KEY_CONFIG"' (quotation marks around $KEY_CONFIG). - This command is taken from revoke-full script –  mulaz Jun 21 '12 at 10:54
    
Oh, you first need to 'export KEY_CN=""', 'export KEY_OU=""' and 'export KEY_NAME=""', and do all this in your 'keys' folder. Just see the revoke-full script, and do the same as the script, without the command with "-revoke" in it. –  mulaz Jun 21 '12 at 10:57
    
Thanks. Btw, I already have KEY_CN, KEY_OU etc in my vars file. –  shadyabhi Jun 21 '12 at 11:10

While revocation toggling is a not so good practice at all, there is some special case where unrevoking a key (like an undo) could be usefull.

Worst: A crt could never be deleted instead of very specific cases, like studying. At end of this, you may see how I delete the last index entry (as an undo action).

unrevoke

There is a little unrevoke script I wrote.

As this is not a standard feature, I've added a kind of log file, called unrevoke.txt, in ASCII format and reusing the structure of index.txt (tab separated):

U | Revocation date | Unrevocation date | Id | unknown | Subject

Warn: It work for my need, but you have to test them before regular use!

#!/bin/bash

# un-revoke a certificate, regenerate CRL,
# and verify revocation status

CRL=crl.pem

if test $# -ne 1; then
    echo "usage: unrevoke <name|idx>";
    exit 1
fi

if test $KEY_DIR; then
    cd $KEY_DIR
    read issuer < <(openssl x509 -issuer -noout -in $KEY_DIR/ca.crt)
    issuer=${issuer#*CN=}
    issuer=${issuer%%/*}
    export KEY_CN=$issuer KEY_OU=$issuer KEY_NAME=$issuer

    if [ -f $1.crt ] ;then
        NAM=$1
    REV=($(sed -ne <index.txt "s/^R\t[^\t]*\t\([0-9]\+Z\)\t\([0-9A-F]\{2,8\}\)\tunknown\t\(.*CN=$1\/.*\)$/\1 \2 \3/p"))
        IDX=${REV[1]}
        SUB="${REV[@]:2}"
    else
        if [ -f $1.pem ] ;then
            IDX=$1
            REV=($(sed -ne <index.txt "s/^R\t[^\t]*\t\([0-9]\+Z\)\t$1\tunknown\t\(.*CN=\([^\/]\+\)\/.*\)$/\1 \3 \2/p"))
            NAM=${REV[1]}
            SUB="${REV[@]:2}"
        fi
    fi
    CRT=$IDX.pem
    if [ -f $CRT ] && [ "$NAM" ] && [ "$IDX" ] ;then
        printf "Key idx: %s, name: %s\n" $IDX $NAM
    else
        echo Key $1 not found.
        exit 1
    fi

    DTE=$(date +"%y%m%d%H%M%SZ")
    # unrevoke key
    sed -e "s/^R\t\([0-9]\+Z\)\t[0-9]\+Z\t$IDX\t/V\t\1\t\t$IDX\t/" -i.old index.txt &&
        printf "U\t%s\t%s\t%s\tunknown\t%s\n" $REV $DTE $IDX "$SUB" >>unrevoke.txt

    # generate a new CRL
    openssl ca -gencrl -out $CRL -config $KEY_CONFIG

    # verify the revocation
    openssl verify -CAfile <(cat ca.crt $CRL) -crl_check $CRT
else
    echo you must define KEY_DIR
fi

delete-last

For info only!!: key as to NEVER be deleted in order to permit his revocation!

#!/bin/bash
# For info only!!
# key as to NEVER be deleted
# for making a correct revocation liste
#
# Don't use it unless you're sure you know what you're doing!!!

cd $KEY_DIR || exit 1

mapfile index <index.txt
OIFS="$IFS"
IFS=$'\t'
line=(${index[${#index[@]}-1]})
IFS="$OIFS"
if [ "$line" == "V" ] ;then
    idx=${line[2]}
    nam=${line[4]#*CN=}
else
    idx=${line[3]}
    nam=${line[5]#*CN=}
fi
nam=${nam%%/*}
rm -v $nam.* $idx.*
unset index[${#index[@]}-1]
cat index.txt >index.txt.old 
printf "%s" "${index[@]}" >index.txt
cat serial >serial.old 
echo ${line[2]} >serial
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.