cli
cli copied to clipboard
Add option to revoke certificates using ACME protocol
What would you like to be added
The ability to revoke certificates using the ACME protocol.
Why this is needed
Users of step-cli already have a method to (passively) revoke certificates created by step-ca using a custom /revoke API and simple invocations from step-cli. This method does the job, but isn't the same as how revocation works in ACME. Adding the ability to revoke certificates using the ACME protocol would:
- Allow revocation by means of an ACME account key or certificate private key, instead of (different) authentication methods provided by the
stepecosystem (i.e. token or mTLS), using a standardized protocol and authorization logic. - Provide a consistent experience across
stepapplications: now that ACME revocation is on the verge of being completed in https://github.com/smallstep/certificates/pull/625, it makes sense to support this method in the CLI too. - Allow users of
step-clito revoke certs using ACME not only whenstep-cawith an ACME provisioner is in use, but also with other (public) ACME CAs.