mirror of
https://github.com/bigchaindb/bigchaindb.git
synced 2024-10-13 13:34:05 +00:00
b6ec3e5f5c
* Support for secure TLS communication in MongoDB, MongoDB Monitoring Agent and MongoDB Backup Agent - Move from Golang to Bash for entrypoint program - Update image tag to 2.0 for Backup and Monitoring Agents and to 3.4.4 for MongoDB - Add documentation * changed title & rewrote Step 1 of workflow.rst * copy-edited ca-installation.rst * copy-edited & modified structure of workflow.rst * moved repeated Easy-RSA install & config docs to new page * edited the sentences describing the Easy-RSA dirs * copy-edited the page about generating server certificate * copy-edited the page about generating client certificate * renamed page to 'How to Set Up a Self-Signed Certificate Authority' * copy-edited page about how to revoke a certificate * Comments on how to uniquely name all instances in the cluster * Added comments about the other questions when setting up a CA * Added note about one Agent Api Key per Cloud Manager backup * docs: clarified instructions for generating server CSR * docs: added back 'from your PKI infrastructure' * docs: fixed step & added step re/ FQDNs & certs in workflow.rst * docs: added note re/ the Distinguished Name * Update docs for env vars setup * docs: added tip: how to get help with the easyrsa command
43 lines
1.3 KiB
ReStructuredText
43 lines
1.3 KiB
ReStructuredText
How to Revoke an SSL/TLS Certificate
|
|
====================================
|
|
|
|
This page enumerates the steps *we* take to revoke a self-signed SSL/TLS certificate
|
|
in a cluster.
|
|
It can only be done by someone with access to the self-signed CA
|
|
associated with the cluster's managing organization.
|
|
|
|
Step 1: Revoke a Certificate
|
|
----------------------------
|
|
|
|
Since we used Easy-RSA version 3 to
|
|
:ref:`set up the CA <How to Set Up a Self-Signed Certificate Authority>`,
|
|
we use it to revoke certificates too.
|
|
|
|
Go to the following directory (associated with the self-signed CA):
|
|
``.../bdb-cluster-ca/easy-rsa-3.0.1/easyrsa3``.
|
|
You need to be aware of the file name used to import the certificate using the
|
|
``./easyrsa import-req`` before. Run the following command to revoke a
|
|
certificate:
|
|
|
|
.. code:: bash
|
|
|
|
./easyrsa revoke <filename>
|
|
|
|
This will update the CA database with the revocation details.
|
|
The next step is to use the updated database to issue an up-to-date
|
|
certificate revocation list (CRL).
|
|
|
|
|
|
Step 2: Generate a New CRL
|
|
--------------------------
|
|
|
|
Generate a new CRL for your infrastructure using:
|
|
|
|
.. code:: bash
|
|
|
|
./easyrsa gen-crl
|
|
|
|
The generated ``crl.pem`` file needs to be uploaded to your infrastructure to
|
|
prevent the revoked certificate from being used again.
|
|
|