update-crl

#!/usr/bin/env bash

# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, You can obtain one at http://mozilla.org/MPL/2.0/.

# Derek Moore <derek.moore@gmail.com>
# Christian Göttsche <cgzones@googlemail.com>
# Tom Bereknyei <tomberek@gmail.com>

set -eu
set -o pipefail

umask 0077

BIN_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
source "${BIN_DIR}/functions"
source "${BIN_DIR}/defaults.conf"

usage() {
    echo "Usage: $0 -c CLIENT_NAME"
    echo "Issues a client certificate for CLIENT_NAME"
    echo
    echo "Options:"
    echo "    -c CLIENT_NAME  Client name (commonName) for the new cert"
    echo
}

if [ ! -f ca/ca.crt ]; then
    echo -e "$ERR Must be run inside a CA directory!"
    exit 2
fi

pushd "${BIN_DIR}/.." > /dev/null

if [ -n "$CA_ENABLE_ENGINE" ]; then
    echo -e "$NOTE Your CA key is on PKCS11 device, enter PIN." >&2
fi
PASS=`ask -s "$INPUT Enter passphrase for signing CA key: " CA_SIGN_PASS_DEFAULT "${SIGN_PASS:-""}"`
echo >&2
export CA_PASS="${PASS}"

openssl_engine_cmd='
    -engine pkcs11 
    -inform engine
    -in pkcs11:object=SIGN%20key'
openssl rsa \
            ${CA_ENABLE_ENGINE:+$openssl_engine_cmd} \
            $( [ -z $CA_ENABLE_ENGINE ] && echo "-check -in ca/private/ca.key") \
            -noout \
            -passin env:CA_PASS

echo -e "$NOTE Creating the CA CRL"

SAN= openssl ca -gencrl -batch \
           ${CA_ENABLE_ENGINE:+$openssl_engine_cmd} \
           -config ca/ca.conf \
           -out ca/ca.crl \
           -passin env:CA_PASS

popd > /dev/null

unset CA_PASS

trap 0

echo -e "$SUCC Updated CRL."