title: Add CRL (certificate revocating list) url to certificates
body: <p>I am generating the root CA using the commands below:</p>
  
  <pre><code>openssl genrsa -aes256 -out ca.key.pem -passout pass:KeyPassword 4096
  openssl req -key ca.key.pem -passin pass:Password -new -x509 -days 365 -sha256 -out ca.root.pem
  </code></pre>
  
  <p>and then I'm creating signed user certificates (without using intermediate certificates) using the commands below:</p>
  
  <p>1) Generate a key for user</p>
  
  <pre><code>openssl req -newkey rsa:2048 -nodes -keyout keyname.pem -days 365
  </code></pre>
  
  <p>2) Create a CSR</p>
  
  <pre><code>openssl req -out keyname.csr -key keyname.pem -new -days 365
  </code></pre>
  
  <p>3) Signing the key with root cert</p>
  
  <pre><code>openssl ca -batch -create_serial -config openssl.cnf -cert ca.root.pem -keyfile ca.key.pem -passin pass:KeyFinalPassword -in keyname.csr -out certname.pem
  </code></pre>
  
  <p>4) Generate .p12 file</p>
  
  <pre><code>openssl pkcs12 -name username -inkey keyname.pem -in certname.pem -export -out username.p12 -password pass:password
  </code></pre>
  
  <p>Note - I've added crlDistributionPoints = URI:<a href="http://localhost:8000/crl/distripoint.crl.pem" rel="nofollow noreferrer">http://localhost:8000/crl/distripoint.crl.pem</a> to the openssl.cnf along with below options:</p>
  
  <pre><code># For certificate revocation lists.
  # crlDistributionPoints = URI:http://HOSTNAME/crl/distripoint.crl.pem
  crlDistributionPoints = URI:http://localhost:8000/crl/distripoint.crl.pem
  crlnumber         = $dir/config/crl/crlnumber
  crl               = $dir/config/crl/ca.crl.pem
  crl_extensions    = crl_ext
  default_crl_days  = 60
  </code></pre>
  
  <p>Note- I generated distribution.crl.pem using <a href="https://jamielinux.com/docs/openssl-certificate-authority/certificate-revocation-lists.html" rel="nofollow noreferrer">this tutorial</a> </p>