#!/bin/bash
#
# YACHT (Yet Another CA How To) Placed in public domain. RLamb 2019
#
wdest="root@mywebserver:/siteroot"
if [ $# -lt 1 ]; then
    echo "Usage $0 serial-no-to-revoke"
    exit 0
fi
read -p "CKA_ID: " kid
lst=`./hcardshow 2>/dev/null | grep ID | cut -f2 -d':' | sort -u`
for i in $lst; do
    if [ "$i" = "$kid" ]; then break; fi
done
if [ "$i" != "$kid" ]; then
    echo "$kid CKA_ID does not exist in HSM. Check with hcardshow."
    exit 0
fi
export SAN=""
openssl ca -config ca.cnf -revoke newcerts/$1.pem -engine pkcs11 -keyform engine -keyfile 1:$kid -cert ca.crt 
echo scp -p index.txt $wdest/docs/ca/ocsp/