Added certificate revocation and CRL generation code.

main.go

@@ -8,9 +8,10 @@ import (
 )
 
 var Version = "dev"
+var configPath string
 
 func main() {
-	var configPath string
+
 	var overwrite bool
 	var subject string
 	var certType string
@@ -20,6 +21,11 @@ func main() {
 	var fromFile string
 	var dryRun bool
 	var verbose bool
+	var crlFile string
+	var crlValidityDays int
+	var revokeName string
+	var revokeSerial string
+	var revokeReasonStr string
 
 	var rootCmd = &cobra.Command{
 		Use:   "lab-ca",
@@ -34,11 +40,7 @@ func main() {
 		Use:   "initca",
 		Short: "Generate a new CA certificate and key",
 		Run: func(cmd *cobra.Command, args []string) {
-			if err := LoadCA(configPath); err != nil {
-				fmt.Printf("Error loading CA config: %v\n", err)
-				os.Exit(1)
-			}
-			InitCA(configPath, overwrite)
+			InitCA(overwrite)
 		},
 	}
 
@@ -49,11 +51,23 @@ func main() {
 		Use:   "issue",
 		Short: "Issue a new certificate (client, server, server-only, code-signing, email)",
 		Run: func(cmd *cobra.Command, args []string) {
-			if err := LoadCA(configPath); err != nil {
-				fmt.Printf("Error loading CA config: %v\n", err)
+			if err := LoadCA(); err != nil {
+				fmt.Fprintf(os.Stderr, "ERROR: %v\n", err)
+				os.Exit(1)
+			}
+			if err := IssueCertificate(configPath,
+				subject,
+				certType,
+				validity,
+				san,
+				name,
+				fromFile,
+				overwrite,
+				dryRun,
+				verbose); err != nil {
+				fmt.Fprintf(os.Stderr, "ERROR: %v\n", err)
 				os.Exit(1)
 			}
-			IssueCertificate(configPath, subject, certType, validity, san, name, fromFile, overwrite, dryRun, verbose)
 		},
 	}
 
@@ -83,9 +97,93 @@ func main() {
 			fmt.Printf("lab-ca version: %s\n", Version)
 		},
 	}
+
+	var crlCmd = &cobra.Command{
+		Use:   "crl",
+		Short: "Generate a Certificate Revocation List (CRL)",
+		Run: func(cmd *cobra.Command, args []string) {
+			if err := LoadCA(); err != nil {
+				fmt.Printf("ERROR: %v\n", err)
+				os.Exit(1)
+			}
+			if crlValidityDays <= 0 {
+				crlValidityDays = 30 // default to 30 days
+			}
+			err := CAState.GenerateCRL(crlFile, crlValidityDays)
+			if err != nil {
+				fmt.Printf("ERROR generating CRL: %v\n", err)
+				os.Exit(1)
+			}
+			fmt.Printf("CRL written to %s (valid for %d days)\n", crlFile, crlValidityDays)
+		},
+	}
+	crlCmd.Flags().StringVar(&crlFile, "crl-file", "crl.pem", "Output path for CRL file (default: crl.pem)")
+	crlCmd.Flags().IntVar(&crlValidityDays, "validity-days", 30, "CRL validity in days (default: 30)")
+
+	var revokeCmd = &cobra.Command{
+		Use:   "revoke",
+		Short: "Revoke a certificate by name or serial number",
+		Run: func(cmd *cobra.Command, args []string) {
+			if err := LoadCA(); err != nil {
+				fmt.Printf("ERROR: %v\n", err)
+				os.Exit(1)
+			}
+			if (revokeName == "" && revokeSerial == "") || (revokeName != "" && revokeSerial != "") {
+				fmt.Println("ERROR: You must specify either --name or --serial (but not both)")
+				os.Exit(1)
+			}
+			serial := ""
+			if revokeName != "" {
+				found := false
+				for _, rec := range CAState.Certificates {
+					if rec.Name == revokeName {
+						serial = rec.Serial
+						found = true
+						break
+					}
+				}
+				if !found {
+					fmt.Printf("ERROR: Certificate with name '%s' not found\n", revokeName)
+					os.Exit(1)
+				}
+			} else {
+				serial = revokeSerial
+			}
+			reasonMap := map[string]int{
+				"unspecified":          0,
+				"keyCompromise":        1,
+				"caCompromise":         2,
+				"affiliationChanged":   3,
+				"superseded":           4,
+				"cessationOfOperation": 5,
+				"certificateHold":      6,
+				"removeFromCRL":        8,
+			}
+			reasonCode, ok := reasonMap[revokeReasonStr]
+			if !ok {
+				fmt.Printf("ERROR: Unknown revocation reason '%s'. Valid reasons: ", revokeReasonStr)
+				for k := range reasonMap {
+					fmt.Printf("%s ", k)
+				}
+				fmt.Println()
+				os.Exit(1)
+			}
+			if err := CAState.RevokeCertificate(serial, reasonCode); err != nil {
+				fmt.Printf("ERROR: %v\n", err)
+				os.Exit(1)
+			}
+			fmt.Printf("Certificate with serial %s revoked (reason: %s, code %d)\n", serial, revokeReasonStr, reasonCode)
+		},
+	}
+	revokeCmd.Flags().StringVar(&revokeName, "name", "", "Certificate name to revoke (mutually exclusive with --serial)")
+	revokeCmd.Flags().StringVar(&revokeSerial, "serial", "", "Certificate serial number to revoke (mutually exclusive with --name)")
+	revokeCmd.Flags().StringVar(&revokeReasonStr, "reason", "cessationOfOperation", "Revocation reason (unspecified, keyCompromise, caCompromise, affiliationChanged, superseded, cessationOfOperation, certificateHold, removeFromCRL)")
+
 	rootCmd.AddCommand(initCmd)
 	rootCmd.AddCommand(issueCmd)
 	rootCmd.AddCommand(versionCmd)
+	rootCmd.AddCommand(crlCmd)
+	rootCmd.AddCommand(revokeCmd)
 
 	if err := rootCmd.Execute(); err != nil {
 		os.Exit(1)
@@ -102,6 +200,8 @@ func printMainHelp() {
 	fmt.Println("  initca     Generate a new CA certificate and key")
 	fmt.Println("  issue      Issue a new client/server certificate")
 	fmt.Println("  version     Show version information")
+	fmt.Println("  crl        Generate a Certificate Revocation List (CRL)")
+	fmt.Println("  revoke      Revoke a certificate by name or serial number")
 	fmt.Println()
 	fmt.Println("Use 'lab-ca <command> --help' for more information about a command.")
 }