Dr. Stephen Henson schrieb:
On Thu, Apr 27, 2006, Martin Mller wrote:
Hi!
Is it possible to explain me shortly, how to revoke a pcks12-File?
BTW: I dont have the .pem-Files anymore.
A PKCS#12 file is a container so your question is a bit like asking how to
revoke a .zip file..
If you want to revoke a certificate in a PKCS#12 file which is form a CA under
your control then you can extract the certificates in PEM format using the
pkcs12 utility. Something like:
openssl pkcs12 -in file.p12 -nokeys -clcerts -out cert.pem
will extract the end entitiy certificate which is probably the one you want.
Thank you for your quick answer. Im a bloody rookie in owning a CA.
So my next Problem:
My Debian Sarge doesnt write a CRL after the command openssl ca -revoke
client2N.cert. Im getting the following messages
Using configuration from /usr/lib/ssl/openssl.cnf
Enter pass phrase for /usr/lib/ssl/misc/demoCA/private/cakey.pem:
Revoking Certificate 934E2BFFA8B8036A.
Data Base Updated
So, where is the DB? I cant find one in the subdirectories unter
/usr/lib/ssl/ . The files which are in there, are completly empty and
they dont get a new modificationdate.
When I try to create e CRL (openssl ca -gencrl -out newca.crl) I get the
follwing error:
Using configuration from /usr/lib/ssl/openssl.cnf
Enter pass phrase for /usr/lib/ssl/misc/demoCA/private/cakey.pem:
unable to load number from /usr/lib/ssl/misc/demoCA/crlnumber
error while loading CRL number
3591:error:0D066096:asn1 encoding routines:a2i_ASN1_INTEGER:short
line:f_int.c:215:
The file newca.crl is created, but whats about the crlnumber?
Thanks for your help,
Martin
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [email protected]
Automated List Manager [EMAIL PROTECTED]
