[Openvpn-devel] [PATCH] Add a revoked cert to the sample keys

[Openvpn-devel] [PATCH] Add a revoked cert to the sample keys

[Steffan Karger]

Allows for easier testing of the revocation functionality.

Signed-off-by: Steffan Karger <steffan@...1856...>
---
 sample/sample-keys/gen-sample-keys.sh | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/sample/sample-keys/gen-sample-keys.sh b/sample/sample-keys/gen-sample-keys.sh
index 725cfc9..301cff2 100755
--- a/sample/sample-keys/gen-sample-keys.sh
+++ b/sample/sample-keys/gen-sample-keys.sh
@@ -52,6 +52,14 @@ openssl pkcs12 -export -nodes -password pass:password \
     -out sample-ca/client.p12 -inkey sample-ca/client.key \
     -in sample-ca/client.crt -certfile sample-ca/ca.crt
 
+# Create a client cert, revoke it, generate CRL
+openssl req -new -nodes -config openssl.cnf \
+    -keyout sample-ca/client-revoked.key -out sample-ca/client-revoked.csr \
+    -subj "/C=KG/ST=NA/O=OpenVPN-TEST/CN=client-revoked/emailAddress=me@...430..."
+openssl ca -batch -config openssl.cnf \
+    -out sample-ca/client-revoked.crt -in sample-ca/client-revoked.csr
+openssl ca -config openssl.cnf -revoke sample-ca/client-revoked.crt
+openssl ca -config openssl.cnf -gencrl -out sample-ca/ca.crl
 
 # Create EC server and client cert (signed by 'regular' RSA CA)
 openssl ecparam -out sample-ca/secp256k1.pem -name secp256k1
@@ -76,3 +84,4 @@ openssl dhparam -out dh2048.pem 2048
 cp sample-ca/*.key .
 cp sample-ca/*.crt .
 cp sample-ca/*.p12 .
+cp sample-ca/*.crl .
-- 
2.7.4

Re: [Openvpn-devel] [PATCH] Add a revoked cert to the sample keys

[Arne Schwabe]

ACK. Great idea to test stuff and if it is only as a documentation
example (aka look in the script how to revoke)


Am 26.10.16 um 21:29 schrieb Steffan Karger:
> Allows for easier testing of the revocation functionality.
>
>

Re: [Openvpn-devel] [PATCH applied] Add a revoked cert to the sample keys

[David Sommerseth]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Your patch has been applied to the dev/pre-push-hook branch

commit a64d76e246042fde40189033b87b126627db5b6b
Author: Steffan Karger
Date:   Wed Oct 26 21:29:19 2016 +0200

     Add a revoked cert to the sample keys

     Signed-off-by: Steffan Karger <steffan@...1856...>
     Acked-by: Arne Schwabe <arne@...1227...>
     Message-Id: <1477510159-5067-1-git-send-email-steffan@...1856...>
     URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg12784.html
     Signed-off-by: David Sommerseth <davids@...515...>


- --
kind regards,

David Sommerseth

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)

iQIcBAEBAgAGBQJYE09/AAoJEIbPlEyWcf3y1NgP/2Gapmp1r18wkkKQCY0D35uJ
YEDQskAsW47hH5cq+bFvNNu64HZcMXi72idAOFwFLAzZQxQoPa/wwk2Snyo7HBEB
YdN7PQkSnM7tTDUj8jJaZAMrjYOiZcLpsGf51t+wl0o0wjK7uZzhqLWUJU92szTR
MuBdXmFXJ23D6gqfzNqefmU6G2W4FHFl4e62QTIi0SWswGfKJfs+Wt5Acpo9xlZi
sGBAeI/p7I5M9+7gwbHFXiSZh5IPA7sQcptfPtv0K7E/64NNlS1GlWGw4+DLFBfM
59AGsmd9XR3X9+n8z1nrbb/cveA/Iq+PnXr1oeYyZta+809nMqtcnbr9PU9riyJu
sn1q5XGOeHuM99Va4CnKtOsbP6/7bByY9cE520IWuM9p3CZrEWPY9aRIuKZUzf2m
JrHKI0+bzD9NG1pvAY101Yw6OqWUzz14kt5NGRkXI76NNvHsBBJ3fpFz2evZRl3q
bnYCM/6cVrRpWHY7NxJQX6Kg6GmqnMUQBqxHQlfEZHVr3sx2qB/EvKtfRbzmvfJD
luGT6y6B86tXwGDub+aji5cdaMV3rtP+rqdKpbqVERu9svQ7LaMG6eFvuOab+cOr
Qh4FN5Fsggfk0udBUPG6eZKCbVh5QvINsXboySIlpx6OutUNVY5xG67iKnBocOdu
fLTAlfltknooNAu0Vjfu
=PnH/
-----END PGP SIGNATURE-----

Re: [Openvpn-devel] [PATCH applied] Add a revoked cert to the sample keys

[David Sommerseth]

[-- Attachment #1.1: Type: text/plain, Size: 746 bytes --]


That should be the master branch.  My scripts obviously needs some more
enhancements.


On 28/10/16 15:15, David Sommerseth wrote:
> Your patch has been applied to the dev/pre-push-hook branch
> 
> commit a64d76e246042fde40189033b87b126627db5b6b
> Author: Steffan Karger
> Date:   Wed Oct 26 21:29:19 2016 +0200
> 
>      Add a revoked cert to the sample keys
> 
>      Signed-off-by: Steffan Karger <steffan@...1856...>
>      Acked-by: Arne Schwabe <arne@...1227...>
>      Message-Id: <1477510159-5067-1-git-send-email-steffan@...1856...>
>      URL: https://www.mail-archive.com/openvpn-devel@...475...t/msg12784.html
>      Signed-off-by: David Sommerseth <davids@...515...>
> 
-- 
kind regards,

David Sommerseth


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 836 bytes --]