pki --signcrl - Issue a Certificate Revocation List (CRL) using a CA certificate and key

       This  sub-command  of  pki(1) is used to issue a Certificate Revocation List (CRL) using a CA certificate
       and private key.

       Revoke a certificate:

         pki --signcrl --cacert ca_cert.der --cakey ca_key.der \
             --reason superseded --cert cert.der > crl.der

       Update an existing CRL with two new revocations, using the certificate's serial number, but no reason:

         pki --signcrl --cacert ca_cert.der --cakey ca_key.der \
             --lastcrl old_crl.der --serial 0123 --serial 0345 > crl.der

       pki --signcrl - Issue a Certificate Revocation List (CRL) using a CA certificate and key

-h,--help
              Print usage information with a summary of the available options.

       -v,--debuglevel
              Set debug level, default: 1.

       -+,--optionsfile
              Read command line options from file.

       -k,--cakeyfile
              CA private key file. Either this or --cakeyid is required.

       -x,--cakeyidhex
              Smartcard or TPM CA private key object handle in hex format with an  optional  0x  prefix.  Either
              this or --cakey is required.

       -c,--cacertfile
              CA certificate file. Required.

       -l,--lifetimedays
              Days  until the CRL gets a nextUpdate, default: 15. Ignored if both an absolute start and end time
              are given.

       -F,--this-updatedatetime
              Absolute time when the validity of  the  CRL  begins.  The  datetime  format  is  defined  by  the
              --dateform option.

       -T,--next-updatedatetime
              Absolute  time  when the validity of the CRL end. The datetime format is defined by the --dateform
              option.

       -D,--dateformformstrptime(3) format for the --this-update and --next-update options, default: %d.%m.%y%T-a,--lastcrlcrl
              CRL of lastUpdate to copy revocations from.

       -b,--basecrlcrl
              Base CRL to create a delta CRL for.

       -u,--crluriuri
              Freshest delta CRL URI to include in CRL. Can be used multiple times.

       -g,--digestdigest
              Digest to use for signature creation. One of md5, sha1, sha224, sha256, sha384,  or  sha512.   The
              default is determined based on the type and size of the signature key.

       -R,--rsa-paddingpadding
              Padding to use for RSA signatures. Either pkcs1 or pss, defaults to pkcs1.

       -X,--criticaloid
              Add a critical extension with the given OID.

       -f,--outformencoding
              Encoding  of the created certificate file. Either der (ASN.1 DER) or pem (Base64 PEM), defaults to
              der.

   RevokedCertificates
       Multiple revoked certificates can be added to the CRL by either providing the  certificate  file  or  the
       respective  serial number directly.  A reason and a timestamp can be configured for each revocation (they
       have to be given before each certificate/serial on the command line).

       -r,--reasonreason
              The  reason  why  the   certificate   was   revoked.   One   of   key-compromise,   ca-compromise,
              affiliation-changed, superseded, cessation-of-operation, or certificate-hold.

       -d,--datets
              Revocation date as Unix timestamp. Defaults to the current time.

       -z,--certfile
              Certificate file to revoke.

       -s,--serialhex
              Hexadecimal encoded serial number of the certificate to revoke.

pki(1)

5.9.13                                             2019-05-06                                   PKI--SIGNCRL(1)

pki--signcrl--cakeyfile|--cakeyidhex--cacertfile [--lifetimedays] [--this-updatedatetime]
                     [--next-updatedatetime] [--lastcrlcrl] [--basecrlcrl] [--crluriuri] [--digestdigest]
                     [--rsa-paddingpadding] [[--reasonreason] [--datets] --certfile|--serialhex]
                     [--criticaloid] [--outformencoding] [--debuglevel]

       pki--signcrl--optionsfilepki--signcrl-h | --help