puppetlabs / puppetserver-ca-cli

A simple Ruby CLI tool to interact with the Puppet Server's included Certificate Authority
Apache License 2.0
3 stars 24 forks source link

(PE-34952) Add --revoked action #110

Closed nmburgan closed 1 year ago

nmburgan commented 1 year ago

This inspects the CRL for a list of revoked serials. It then searches inventory.txt for those serials. If the given serial is the latest one for the particular certname, it puts it on a list for deletion (although it may in fact already be deleted). If it's an old serial for a particular certname, it verifies the cert on disk is a later serial. If for some reason it isn't, it removes the cert on disk as it matches the serial in the CRL. If it isn't in inventory.txt at all, it searches all certs on disk for the given serial. If it's found, it adds that cert to the list for deletion. It then deletes all relevant certs that exist.