#!/bin/sh

# Take the correct binary to create the certificates
CERTTOOL=$(which gnutls-certtool || which certtool)
if [ -z "$CERTTOOL" ]
then
  echo "ERROR: No certtool found" >&2
  exit 1
fi

. ./vars

# CRL - Certificate Revocation List
cat <<EOF >crl.info
expiration_days = $EXPIRATION_DAYS
EOF

$CERTTOOL \
  --generate-crl \
  --load-ca-privkey ca.key.pem \
  --load-ca-certificate ca.cert.pem \
  --template crl.info \
  --outfile server.crl.pem

chmod 600 server.crl.pem
rm crl.info
exit 0

# To create a CRL that contains some revoked certificates, place the
# certificates in a file and use --load-certificate as follows:
# $CERTTOOL \
#   --generate-crl \
#   --load-ca-privkey ca.key.pem \
#   --load-ca-certificate ca.cert.pem \
#   --load-certificate revoked-certs.pem

# To verify a CRL:
#   $CERTTOOL --verify-crl --load-ca-certificate ca.cert.pem --infile server.crl.pem

