Document how to generate CRLs.

diff --git a/NEWS b/NEWS
index fccdbf94f803d3ff9bee1228572d5ccb33dd14ee..f8618e475c85807145242d3372973ea5bd1e3622 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -5,6 +5,9 @@ See the end for copying conditions.
 
 * Version 2.3.5 (unreleased)
 
+** Document how to generate CRLs.
+Suggested by "Rainer Gerhards" <rgerhards@gmail.com>.
+
 ** Documented the --priority option to gnutls-cli and gnutls-serv.
 
 ** Several minor fixes in the OpenPGP interface. Thanks to Daniel Kahn

diff --git a/THANKS b/THANKS
index bb302145e95f2e3c5c5712912b8e932256879029..520d7a2ddb624f44fed9cb3dc785174679eee86b 100644 (file)
--- a/THANKS
+++ b/THANKS
@@ -75,6 +75,7 @@ Dennis Vshivkov                 <walrus@amur.ru>
 Kristofer T. Karas              <ktk@enterprise.bidmc.harvard.edu>
 Marc Haber                      <mh+debian-bugs@zugschlus.de>
 Tim Mooney                     <tim@tim-the-enchanter.org>
+Rainer Gerhards                 <rgerhards@gmail.com>
 
 ----------------------------------------------------------------------
 Copying and distribution of this file, with or without modification,

diff --git a/doc/gnutls.texi b/doc/gnutls.texi
index 527c23ddd3169c742fe34d1f4844b754d5ee7372..612e126c552a587a3e3cefa8545e6a6fd1d723ba 100644 (file)
--- a/doc/gnutls.texi
+++ b/doc/gnutls.texi
@@ -3056,6 +3056,27 @@ $ certtool --generate-proxy --load-ca-privkey key.pem \
   --outfile proxy-cert.pem
 @end example
 
+@item
+To create an empty Certificate Revocation List (CRL) do:
+
+@example
+$ certtool --generate-crl --load-ca-privkey x509-ca-key.pem --load-ca-certificate x509-ca.pem
+@end example
+
+To create a CRL that contains some revoked certificates, place the
+certificates in a file and use @code{--load-certificate} as follows:
+
+@example
+$ certtool --generate-crl --load-ca-privkey x509-ca-key.pem --load-ca-certificate x509-ca.pem --load-certificate revoked-certs.pem
+@end example
+
+@item
+To verify a Certificate Revocation List (CRL) do:
+
+@example
+$ certtool --verify-crl --load-ca-certificate x509-ca.pem < crl.pem
+@end example
+
 @end itemize
 
 Certtool's template file format: