cli icon indicating copy to clipboard operation
cli copied to clipboard

Add option to revoke certificates using ACME protocol

Open hslatman opened this issue 3 years ago • 0 comments

What would you like to be added

The ability to revoke certificates using the ACME protocol.

Why this is needed

Users of step-cli already have a method to (passively) revoke certificates created by step-ca using a custom /revoke API and simple invocations from step-cli. This method does the job, but isn't the same as how revocation works in ACME. Adding the ability to revoke certificates using the ACME protocol would:

  • Allow revocation by means of an ACME account key or certificate private key, instead of (different) authentication methods provided by the step ecosystem (i.e. token or mTLS), using a standardized protocol and authorization logic.
  • Provide a consistent experience across step applications: now that ACME revocation is on the verge of being completed in https://github.com/smallstep/certificates/pull/625, it makes sense to support this method in the CLI too.
  • Allow users of step-cli to revoke certs using ACME not only when step-ca with an ACME provisioner is in use, but also with other (public) ACME CAs.

hslatman avatar Dec 06 '21 09:12 hslatman