Add TLS CRL option

* harden OpenSSL usage
 * CRL: init/script
 * nDPIsrvd.h: increase max JSON tokens

Signed-off-by: Toni Uhlig <matzeton@googlemail.com>

dependencies/nDPIsrvd.h

@@ -30,7 +30,7 @@
 #include <stdarg.h>
 #endif
 
-#define nDPIsrvd_MAX_JSON_TOKENS (512u)
+#define nDPIsrvd_MAX_JSON_TOKENS (1024u)
 #define nDPIsrvd_JSON_KEY_STRLEN (32)
 #define nDPIsrvd_HASHKEY_SEED (0x995fd871ull | ((0xe6546b64ull) << 32u))
 

examples/c-captured/c-captured.c

@@ -181,7 +181,11 @@ static void decode_base64(pcap_dumper_t * const pd,
 
     if (nDPIsrvd_base64decode(base64_packet, base64_packet_size, pkt_buf, &pkt_buf_len) != 0 || pkt_buf_len == 0)
     {
-        logger(1, "packet base64 decode failed (%zu bytes): %s", base64_packet_size, base64_packet);
+        if (base64_packet != NULL) {
+            logger(1, "Packet event Base64 decode failed (%zu bytes): %s", base64_packet_size, base64_packet);
+        } else {
+            logger(1, "Packet event Base64 decode failed (%zu bytes)", base64_packet_size);
+        }
     }
     else
     {

nDPId.c

@@ -542,6 +542,7 @@ static struct
     struct cmdarg client_crt_pem_file;
     struct cmdarg client_key_pem_file;
     struct cmdarg server_ca_pem_file;
+    struct cmdarg crl_pem_file;
 #endif
     /* subopts */
     struct cmdarg max_flows_per_thread;
@@ -597,6 +598,7 @@ static struct
                    .client_crt_pem_file = CMDARG_STR(NULL),
                    .client_key_pem_file = CMDARG_STR(NULL),
                    .server_ca_pem_file = CMDARG_STR(NULL),
+                   .crl_pem_file = CMDARG_STR(NULL),
 #endif
                    .max_flows_per_thread = CMDARG_ULL(nDPId_MAX_FLOWS_PER_THREAD / 2),
                    .max_idle_flows_per_thread = CMDARG_ULL(nDPId_MAX_IDLE_FLOWS_PER_THREAD / 2),
@@ -660,6 +662,7 @@ struct confopt general_config_map[] = {CONFOPT("netif", &nDPId_options.pcap_file
                                        CONFOPT("cert-pem-file", &nDPId_options.client_crt_pem_file),
                                        CONFOPT("key-pem-file", &nDPId_options.client_key_pem_file),
                                        CONFOPT("ca-pem-file", &nDPId_options.server_ca_pem_file),
+                                       CONFOPT("crl-pem-file", &nDPId_options.crl_pem_file),
 #endif
 };
 struct confopt tuning_config_map[] = {
@@ -6112,6 +6115,8 @@ static void print_usage(char const * const arg0)
         "\t  \tDefault: disabled\n"
         "\t-F\tPath to the server CA file (PEM format)\n"
         "\t  \tDefault: disabled\n"
+        "\t-V\tPath to the CRL file (PEM format)\n"
+        "\t  \tDefault: disabled\n"
 #endif
 #ifdef ENABLE_EPOLL
         "\t-e\tUse poll() instead of epoll().\n"
@@ -6239,7 +6244,7 @@ static int nDPId_parse_options(int argc, char ** argv)
 {
     int opt;
 
-    while ((opt = getopt(argc, argv, "f:i:rIEB:tlL:c:k:K:F:edp:u:g:R:P:C:J:S:a:U:Azo:vh")) != -1)
+    while ((opt = getopt(argc, argv, "f:i:rIEB:tlL:c:k:K:F:V:edp:u:g:R:P:C:J:S:a:U:Azo:vh")) != -1)
     {
         switch (opt)
         {
@@ -6304,6 +6309,14 @@ static int nDPId_parse_options(int argc, char ** argv)
 #else
                 logger(1, "Server CA PEM file: %s", "nDPId was built w/o OpenSSL/Crypto support");
                 return 1;
+#endif
+            case 'V':
+#ifdef ENABLE_CRYPTO
+                set_cmdarg_string(&nDPId_options.crl_pem_file, optarg);
+                break;
+#else
+                logger(1, "CRL PEM file: %s", "nDPId was built w/o OpenSSL/Crypto support");
+                return 1;
 #endif
             case 'e':
 #ifdef ENABLE_EPOLL
@@ -6686,6 +6699,11 @@ static int validate_options(void)
         logger_early(1, "%s", "Encryption requires an TCP endpoint set with `-c'.");
         retval = 1;
     }
+    if (nDPId_TLS_USED() == 0 && IS_CMDARG_SET(nDPId_options.crl_pem_file) != 0)
+    {
+        logger_early(1, "%s", "Setting a CRL requires enabled TLS. See `-k', `-K' and `-F'.");
+        return 1;
+    }
 #endif
 
     return retval;
@@ -6824,7 +6842,8 @@ int main(int argc, char ** argv)
         ncrypt_init_client(&ncrypt_ctx,
                            GET_CMDARG_STR(nDPId_options.server_ca_pem_file),
                            GET_CMDARG_STR(nDPId_options.client_key_pem_file),
-                           GET_CMDARG_STR(nDPId_options.client_crt_pem_file)) != NCRYPT_SUCCESS)
+                           GET_CMDARG_STR(nDPId_options.client_crt_pem_file),
+                           GET_CMDARG_STR(nDPId_options.crl_pem_file)) != NCRYPT_SUCCESS)
     {
         logger_early(1, "%s", "Could not initialize crypto.");
         return 1;

nDPIsrvd.c

@@ -146,6 +146,7 @@ static struct
     struct cmdarg server_crt_pem_file;
     struct cmdarg server_key_pem_file;
     struct cmdarg server_ca_pem_file;
+    struct cmdarg crl_pem_file;
 #endif
 } nDPIsrvd_options = {.config_file = CMDARG_STR(NULL),
                       .pidfile = CMDARG_STR(nDPIsrvd_PIDFILE),
@@ -167,7 +168,8 @@ static struct
                           ,
                       .server_crt_pem_file = CMDARG_STR(NULL),
                       .server_key_pem_file = CMDARG_STR(NULL),
-                      .server_ca_pem_file = CMDARG_STR(NULL)
+                      .server_ca_pem_file = CMDARG_STR(NULL),
+                      .crl_pem_file = CMDARG_STR(NULL),
 #endif
 };
 struct confopt config_map[] = {CONFOPT("pidfile", &nDPIsrvd_options.pidfile),
@@ -189,7 +191,8 @@ struct confopt config_map[] = {CONFOPT("pidfile", &nDPIsrvd_options.pidfile),
                                    ,
                                CONFOPT("cert-pem-file", &nDPIsrvd_options.server_crt_pem_file),
                                CONFOPT("key-pem-file", &nDPIsrvd_options.server_key_pem_file),
-                               CONFOPT("ca-pem-file", &nDPIsrvd_options.server_ca_pem_file)
+                               CONFOPT("ca-pem-file", &nDPIsrvd_options.server_ca_pem_file),
+                               CONFOPT("crl-pem-file", &nDPIsrvd_options.crl_pem_file),
 #endif
 };
 
@@ -1005,7 +1008,9 @@ static void free_remotes(struct nio * const io)
 {
     for (size_t i = 0; i < remotes.desc_size; ++i)
     {
-        free_remote(io, &remotes.desc[i]);
+        if (remotes.desc[i].fd >= 0) {
+            free_remote(io, &remotes.desc[i]);
+        }
     }
     nDPIsrvd_free(remotes.desc);
     remotes.desc = NULL;
@@ -1074,7 +1079,7 @@ static int nDPIsrvd_parse_options(int argc, char ** argv)
 {
     int opt;
 
-    while ((opt = getopt(argc, argv, "f:lL:c:C:k:K:F:edp:s:S:G:m:u:g:M:vh")) != -1)
+    while ((opt = getopt(argc, argv, "f:lL:c:C:k:K:F:V:edp:s:S:G:m:u:g:M:vh")) != -1)
     {
         switch (opt)
         {
@@ -1101,7 +1106,7 @@ static int nDPIsrvd_parse_options(int argc, char ** argv)
                 set_cmdarg_string(&nDPIsrvd_options.server_crt_pem_file, optarg);
                 break;
 #else
-                logger_early(1, "%s", "nDPIsrvd was built w/o OpenSSL/Crypto support");
+                logger_early(1, "Server cert PEM file: %s", "nDPIsrvd was built w/o OpenSSL/Crypto support");
                 return 1;
 #endif
             case 'K':
@@ -1109,7 +1114,7 @@ static int nDPIsrvd_parse_options(int argc, char ** argv)
                 set_cmdarg_string(&nDPIsrvd_options.server_key_pem_file, optarg);
                 break;
 #else
-                logger_early(1, "%s", "nDPIsrvd was built w/o OpenSSL/Crypto support");
+                logger_early(1, "Server key PEM file: %s", "nDPIsrvd was built w/o OpenSSL/Crypto support");
                 return 1;
 #endif
             case 'F':
@@ -1117,7 +1122,15 @@ static int nDPIsrvd_parse_options(int argc, char ** argv)
                 set_cmdarg_string(&nDPIsrvd_options.server_ca_pem_file, optarg);
                 break;
 #else
-                logger_early(1, "%s", "nDPIsrvd was built w/o OpenSSL/Crypto support");
+                logger_early(1, "Server CA PEM file: %s", "nDPIsrvd was built w/o OpenSSL/Crypto support");
+                return 1;
+#endif
+            case 'V':
+#ifdef ENABLE_CRYPTO
+                set_cmdarg_string(&nDPIsrvd_options.crl_pem_file, optarg);
+                break;
+#else
+                logger_early(1, "CRL PEM file: %s", "nDPIsrvd was built w/o OpenSSL/Crypto support");
                 return 1;
 #endif
             case 'e':
@@ -1212,8 +1225,13 @@ static int nDPIsrvd_parse_options(int argc, char ** argv)
                         "\t-C\tAddress:Port of the listening TCP/IP socket (nDPIsrvd Collector).\n"
 #ifdef ENABLE_CRYPTO
                         "\t-k\tPath to the server certificate file (PEM format).\n"
+                        "\t  \tDefault: disabled\n"
                         "\t-K\tPath to the server key file (PEM format).\n"
+                        "\t  \tDefault: disabled\n"
                         "\t-F\tPath to the client CA file (PEM format).\n"
+                        "\t  \tDefault: disabled\n"
+                        "\t-V\tPath to the CRL file (PEM format).\n"
+                        "\t  \tDefault: disabled\n"
 #endif
                         "\t-e\tUse poll() instead of epoll().\n"
                         "\t  \tDefault: epoll() on Linux, poll() otherwise\n"
@@ -1323,6 +1341,11 @@ static int nDPIsrvd_parse_options(int argc, char ** argv)
         logger_early(1, "%s", "TLS requires a TCP collector endpoint `-C' or TCP distributor endpoint `-S'.");
         return 1;
     }
+    if (nDPIsrvd_TLS_USED() == 0 && IS_CMDARG_SET(nDPIsrvd_options.crl_pem_file) != 0)
+    {
+        logger_early(1, "%s", "Setting a CRL requires enabled TLS. See `-k', `-K' and `-F'.");
+        return 1;
+    }
 #endif
 
     if (optind < argc)
@@ -2007,6 +2030,7 @@ static int mainloop(struct nio * const io)
 
             if (clock_gettime(CLOCK_REALTIME, &now) != 0)
             {
+                close(ncrypt_handshake_timerfd);
                 return 1;
             }
             timeout.it_value.tv_sec = now.tv_sec + TLS_HANDSHAKE_TIMEOUT;
@@ -2015,6 +2039,7 @@ static int mainloop(struct nio * const io)
             timeout.it_interval.tv_nsec = 0;
             if (timerfd_settime(ncrypt_handshake_timerfd, TFD_TIMER_ABSTIME, &timeout, NULL) != 0)
             {
+                close(ncrypt_handshake_timerfd);
                 return 1;
             }
         }
@@ -2022,6 +2047,7 @@ static int mainloop(struct nio * const io)
         {
             logger(1, "Error adding TLS handshake timer: %s",
                    (errno != 0 ? strerror(errno) : "Internal Error"));
+            close(ncrypt_handshake_timerfd);
             return 1;
         }
     }
@@ -2367,7 +2393,8 @@ int main(int argc, char ** argv)
         if (ncrypt_init_server(&ncrypt_ctx,
                                GET_CMDARG_STR(nDPIsrvd_options.server_ca_pem_file),
                                GET_CMDARG_STR(nDPIsrvd_options.server_key_pem_file),
-                               GET_CMDARG_STR(nDPIsrvd_options.server_crt_pem_file)) != NCRYPT_SUCCESS)
+                               GET_CMDARG_STR(nDPIsrvd_options.server_crt_pem_file),
+                               GET_CMDARG_STR(nDPIsrvd_options.crl_pem_file)) != NCRYPT_SUCCESS)
         {
             logger_early(1, "%s", "Could not initialize crypto.");
             return 1;
@@ -2415,7 +2442,7 @@ int main(int argc, char ** argv)
 #endif
         {
             logger(1,
-                   "Please keep in mind that using a TCP Distributor without TLS may leak sensitive information to "
+                   "Please keep in mind that using a TCP Collector/Distributor without TLS may leak sensitive information to "
                    "everyone with access to the device/network. You've been warned!");
         }
     }

ncrypt.c

@@ -2,7 +2,6 @@
 
 #include <endian.h>
 #include <openssl/conf.h>
-#include <openssl/core_names.h>
 #include <openssl/err.h>
 #include <openssl/pem.h>
 #include <openssl/ssl.h>
@@ -40,8 +39,10 @@ ncrypt_strerror(int ncrypt_error)
 
 int ncrypt_init(void)
 {
-    SSL_load_error_strings();
-    OpenSSL_add_all_algorithms();
+    if (OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS | OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL) != 1)
+    {
+        return NCRYPT_NOT_INITIALIZED;
+    }
     //ERR_print_errors_fp(stderr);
 
     return NCRYPT_SUCCESS;
@@ -65,6 +66,7 @@ static int ncrypt_init_ctx(struct ncrypt_ctx * const ctx, SSL_METHOD const * con
     }
 
     SSL_CTX_set_mode(ctx->ssl_ctx, SSL_MODE_AUTO_RETRY);
+    SSL_CTX_set_options(ctx->ssl_ctx, SSL_OP_NO_RENEGOTIATION | SSL_OP_NO_COMPRESSION | SSL_OP_NO_TICKET);
     SSL_CTX_set_min_proto_version(ctx->ssl_ctx, TLS1_3_VERSION);
     SSL_CTX_set_max_proto_version(ctx->ssl_ctx, TLS1_3_VERSION);
     SSL_CTX_set_ciphersuites(ctx->ssl_ctx, "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256");
@@ -72,10 +74,43 @@ static int ncrypt_init_ctx(struct ncrypt_ctx * const ctx, SSL_METHOD const * con
     return NCRYPT_SUCCESS;
 }
 
+static int ncrypt_load_crl(struct ncrypt_ctx * const ctx, char const * const crl_pem_path)
+{
+    if (crl_pem_path == NULL)
+    {
+        return NCRYPT_SUCCESS;
+    }
+
+    X509_STORE * const store = SSL_CTX_get_cert_store(ctx->ssl_ctx);
+    if (store == NULL)
+    {
+        return NCRYPT_NOT_INITIALIZED;
+    }
+
+    X509_LOOKUP * const lookup = X509_STORE_add_lookup(store, X509_LOOKUP_file());
+    if (lookup == NULL ||
+        X509_load_crl_file(lookup, crl_pem_path, X509_FILETYPE_PEM) <= 0)
+    {
+        char err_buf[256];
+        ERR_error_string_n(ERR_get_error(), err_buf, sizeof(err_buf));
+        logger_early(1, "Failed to load CRL `%s': %s", crl_pem_path, err_buf);
+        while (ERR_get_error() != 0) {}
+        return NCRYPT_PEM_LOAD_FAILED;
+    }
+
+    if (X509_STORE_set_flags(store, X509_V_FLAG_CRL_CHECK) != 1)
+    {
+        return NCRYPT_PEM_LOAD_FAILED;
+    }
+
+    return NCRYPT_SUCCESS;
+}
+
 static int ncrypt_load_pems(struct ncrypt_ctx * const ctx,
                             char const * const ca_path,
                             char const * const privkey_pem_path,
-                            char const * const cert_pem_path)
+                            char const * const cert_pem_path,
+                            char const * const crl_path)
 {
     char err_buf[256];
 
@@ -107,6 +142,13 @@ static int ncrypt_load_pems(struct ncrypt_ctx * const ctx,
         return NCRYPT_PEM_LOAD_FAILED;
     }
 
+    if (crl_path != NULL) {
+        int rv = ncrypt_load_crl(ctx, crl_path);
+        if (rv != NCRYPT_SUCCESS) {
+            return rv;
+        }
+    }
+
     SSL_CTX_set_verify(ctx->ssl_ctx, SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT, NULL);
     SSL_CTX_set_verify_depth(ctx->ssl_ctx, 1);
     return NCRYPT_SUCCESS;
@@ -115,7 +157,8 @@ static int ncrypt_load_pems(struct ncrypt_ctx * const ctx,
 int ncrypt_init_client(struct ncrypt_ctx * const ctx,
                        char const * const ca_path,
                        char const * const privkey_pem_path,
-                       char const * const cert_pem_path)
+                       char const * const cert_pem_path,
+                       char const * const crl_path)
 {
     if (ca_path == NULL || privkey_pem_path == NULL || cert_pem_path == NULL)
     {
@@ -129,13 +172,14 @@ int ncrypt_init_client(struct ncrypt_ctx * const ctx,
         return rv;
     }
 
-    return ncrypt_load_pems(ctx, ca_path, privkey_pem_path, cert_pem_path);
+    return ncrypt_load_pems(ctx, ca_path, privkey_pem_path, cert_pem_path, crl_path);
 }
 
 int ncrypt_init_server(struct ncrypt_ctx * const ctx,
                        char const * const ca_path,
                        char const * const privkey_pem_path,
-                       char const * const cert_pem_path)
+                       char const * const cert_pem_path,
+                       char const * const crl_path)
 {
     if (ca_path == NULL || privkey_pem_path == NULL || cert_pem_path == NULL)
     {
@@ -149,7 +193,9 @@ int ncrypt_init_server(struct ncrypt_ctx * const ctx,
         return rv;
     }
 
-    return ncrypt_load_pems(ctx, ca_path, privkey_pem_path, cert_pem_path);
+    SSL_CTX_set_num_tickets(ctx->ssl_ctx, 0);
+
+    return ncrypt_load_pems(ctx, ca_path, privkey_pem_path, cert_pem_path, crl_path);
 }
 
 int ncrypt_on_connect(struct ncrypt_ctx * const ctx, int connect_fd, struct ncrypt_entity * const ent)
@@ -163,6 +209,7 @@ int ncrypt_on_connect(struct ncrypt_ctx * const ctx, int connect_fd, struct ncry
             return NCRYPT_NOT_INITIALIZED;
         }
         SSL_set1_host(ent->ssl, "nDPIsrvd");
+        SSL_set_purpose(ent->ssl, X509_PURPOSE_SSL_CLIENT);
         SSL_set_hostflags(ent->ssl, X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS);
         SSL_set_fd(ent->ssl, connect_fd);
         SSL_set_connect_state(ent->ssl);
@@ -186,6 +233,11 @@ int ncrypt_on_connect(struct ncrypt_ctx * const ctx, int connect_fd, struct ncry
         return NCRYPT_HANDSHAKE_FAILED;
     }
 
+    if (SSL_get_verify_result(ent->ssl) != X509_V_OK) {
+        ent->last_ncrypt_error = NCRYPT_HANDSHAKE_FAILED;
+        return NCRYPT_HANDSHAKE_FAILED;
+    }
+
     return NCRYPT_SUCCESS;
 }
 
@@ -201,6 +253,7 @@ int ncrypt_on_accept(struct ncrypt_ctx * const ctx, int accept_fd, struct ncrypt
         }
         SSL_set_fd(ent->ssl, accept_fd);
         SSL_set_accept_state(ent->ssl);
+        SSL_set_purpose(ent->ssl, X509_PURPOSE_SSL_SERVER);
     }
 
     int rv = SSL_accept(ent->ssl);
@@ -221,7 +274,12 @@ int ncrypt_on_accept(struct ncrypt_ctx * const ctx, int accept_fd, struct ncrypt
         return NCRYPT_HANDSHAKE_FAILED;
     }
 
-    X509 * const peer = SSL_get_peer_certificate(ent->ssl);
+    if (SSL_get_verify_result(ent->ssl) != X509_V_OK) {
+        ent->last_ncrypt_error = NCRYPT_HANDSHAKE_FAILED;
+        return NCRYPT_HANDSHAKE_FAILED;
+    }
+
+    X509 * const peer = SSL_get1_peer_certificate(ent->ssl);
     if (peer == NULL)
     {
         ent->last_ncrypt_error = NCRYPT_HANDSHAKE_FAILED;

ncrypt.h

@@ -75,13 +75,15 @@ WARN_UNUSED
 int ncrypt_init_client(struct ncrypt_ctx * const ctx,
                        char const * const ca_path,
                        char const * const privkey_pem_path,
-                       char const * const cert_pem_path);
+                       char const * const cert_pem_path,
+                       char const * const crl_path);
 
 WARN_UNUSED
 int ncrypt_init_server(struct ncrypt_ctx * const ctx,
                        char const * const ca_path,
                        char const * const privkey_pem_path,
-                       char const * const cert_pem_path);
+                       char const * const cert_pem_path,
+                       char const * const crl_path);
 
 WARN_UNUSED
 int ncrypt_on_connect(struct ncrypt_ctx * const ctx, int connect_fd, struct ncrypt_entity * const ent);

ndpid.conf.example

@@ -29,6 +29,7 @@ collector   = /run/nDPIsrvd/collector
 #cert-pem-file = /path/to/client-crt.pem
 #key-pem-file  = /path/to/client-key.pem
 #ca-pem-file   = /path/to/ca.pem
+#crl-pem-file	 = /path/to/crl.pem
 
 # Set a name for this nDPId instance
 #alias       = myhostname

ndpisrvd.conf.example

@@ -19,6 +19,7 @@
 #cert-pem-file = /path/to/server-crt.pem
 #key-pem-file  = /path/to/server-key.pem
 #ca-pem-file   = /path/to/ca.pem
+#crl-pem-file	 = /path/to/crl.pem
 
 # Change group of the collector socket
 #collector-group        = daemon

scripts/gen-cacerts.sh

@@ -31,12 +31,31 @@ OLDPWD="$(pwd)"
 mkdir -p "${OUT_DIR}"
 cd "${OUT_DIR}"
 
+cat <<EOF >./openssl.conf
+[ca]
+default_ca=CA
+[CA]
+database=./crl_index.txt
+crlnumber=./crl_num.txt
+certificate=./ca.crt
+private_key=./ca.key
+default_md=sha384
+default_crl_days=30
+EOF
+
 if [[ ! -r ./ca.key || ! -r ./ca.crt ]]; then
     printf '%s\n' '[*] Create CA...'
     openssl genrsa -out ./ca.key 4096
     openssl req -x509 -new -nodes -key ./ca.key -sha256 -days 3650 -out ./ca.crt -subj "/CN=nDPId Root CA"
 fi
 
+if [[ ! -r ./crl.crt ]]; then
+    CRLNUM=$(date +%s)
+    [ -r ./crl_index.txt ] || : >./crl_index.txt
+    printf '%s' "${CRLNUM}" >./crl_num.txt
+    openssl ca -gencrl -config ./openssl.conf -out ./crl.crt
+fi
+
 if [[ ! -r ./server_${SERVER_CN}.key || ! -r ./server_${SERVER_CN}.crt ]]; then
     printf '[*] Create Server Cert: %s\n' "${SERVER_CN}"
     openssl genrsa -out ./server_${SERVER_CN}.key 2048
@@ -50,7 +69,8 @@ if [[ ! -r ./client_collector_${CLIENT_CN}.key || ! -r ./client_collector_${CLIE
     openssl genrsa -out ./client_collector_${CLIENT_CN}.key 2048
     openssl req -new -key ./client_collector_${CLIENT_CN}.key -out ./client_collector_${CLIENT_CN}.csr \
         -subj "/CN=${CLIENT_CN}" -addext "subjectAltName=DNS:collector"
-    openssl x509 -req -in ./client_collector_${CLIENT_CN}.csr -CA ./ca.crt -CAkey ./ca.key -CAcreateserial \
+    openssl x509 \
+        -req -in ./client_collector_${CLIENT_CN}.csr -CA ./ca.crt -CAkey ./ca.key -CAcreateserial \
         -out ./client_collector_${CLIENT_CN}.crt -days 825 -sha256 -copy_extensions copy
 fi
 
@@ -59,7 +79,8 @@ if [[ ! -r ./client_distributor_${CLIENT_CN}.key || ! -r ./client_distributor_${
     openssl genrsa -out ./client_distributor_${CLIENT_CN}.key 2048
     openssl req -new -key ./client_distributor_${CLIENT_CN}.key -out ./client_distributor_${CLIENT_CN}.csr \
         -subj "/CN=${CLIENT_CN}" -addext "subjectAltName=DNS:distributor"
-    openssl x509 -req -in ./client_distributor_${CLIENT_CN}.csr -CA ./ca.crt -CAkey ./ca.key -CAcreateserial \
+    openssl x509 \
+        -req -in ./client_distributor_${CLIENT_CN}.csr -CA ./ca.crt -CAkey ./ca.key -CAcreateserial \
         -out ./client_distributor_${CLIENT_CN}.crt -days 825 -sha256 -copy_extensions copy
 fi
 

scripts/revoke-cert.sh

@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+
+printf 'usage: %s [out-dir] [client-cert]' "${0}"
+
+if [[ -z "${1}" ]]; then
+    OUT_DIR="$(dirname ${0})/pki"
+else
+    OUT_DIR="${1}"
+fi
+
+if [[ -z "${2}" ]]; then
+    CLIENT_CERT="./client_distributor_unknown.crt"
+else
+    CLIENT_CERT="${2}"
+fi
+
+printf 'PKI Directory: %s\n' "${OUT_DIR}"
+printf 'Client Cert..: %s\n' "${CLIENT_CERT}"
+
+set -e
+set -x
+
+OLDPWD="$(pwd)"
+mkdir -p "${OUT_DIR}"
+cd "${OUT_DIR}"
+
+openssl ca -config ./openssl.conf -revoke "${CLIENT_CERT}" -crl_reason keyCompromise
+openssl ca -gencrl -config ./openssl.conf -out ./crl.crt
+
+printf '%s\n' '[*] Done'
+
+cd "${OLDPWD}"