Massive revocation

[talcher]

Hello the EJBCA team,

suppose that:

• you have different CAs;
• for one of them, you have a large bunch of active certificates. By "a large bunch", I mean so big a number, that you cannot find them all by a webadmin research;
• you would like to revoke, at once, all active certificates issued by that particular CA.

I thought there would be a CLI command to do so, but I cannot find it.
Would you please help me?

If there is one, is there a way to apply some more precise filters? For example, to revoke all certificates (i) signed by the CA foo AND (ii) whose public key is of such type AND (iii) whose notBefore is the date bar.

Thanks a lot,

talcher

[dvanzuijlekom]

You could query the information directly from the database and use this as input for the CLI to iterate over the individual serial numbers, e.g.:

SELECT serialNumber FROM CertificateData WHERE issuerDN = 'CN=Your CA DN' AND status = 20;

You could add more specific conditions depending on your use-case.

Just remember to add a sleep in your loop so the CLI isn't hammering the CA with the mass revocations...