CRL generation

[discount-elf]

Is this a planned feature?

[kisom]

@sigil66 This is a planned feature (and I've done some work on to this end), but we have some other features that we are working on first.

[discount-elf]

Great! Thank you!

[jedsmith]

Any progress here? Thanks!

[databus23]

I'm also interested in this. Any update on this?

[kisom]

We've decided to work on this for version 1.2; the next release is 1.1, so it will be a little while before we dedicate any engineering resources here to work on this.

[databus23]

Thanks! I would also look into taking on this issue if this would be welcome.

In general I'm wondering how do you want to implement crls: Do you want to add some kind of persistence for revoked certificates (serial and reason) to cfssl or should the complete list of revoked certificates be provided every time a crl is (re)generated?

[kisom]

In general, we prefer not to maintain persistence in CFSSL—this provides the most flexibility in how the system will be used. It would be better if the list of revoked certificates is provided. I'd intended to support both full and delta CRLs so that the whole CRL doesn't necessarily need to be provided each time.

[lziest]

We already have crl package implemented, thanks to William Lewis @wl2002. and we have cli/gencrl and api/crl as well.

[discount-elf]

❤️