#!/bin/bash

#
# Revoke a client certificate
#

if [ "$DEBUG" == "1" ]; then
    set -x
fi

set -e

if [ -z "$OPENVPN" ]; then
    export OPENVPN="$PWD"
fi
if ! source "$OPENVPN/ovpn_env.sh"; then
    echo "Could not source $OPENVPN/ovpn_env.sh."
    exit 1
fi
if [ -z "$EASYRSA_PKI" ]; then
    export EASYRSA_PKI="$OPENVPN/pki"
fi

cn="$1"

if [ ! -f "$EASYRSA_PKI/private/${cn}.key" ]; then
    echo "Unable to find \"${cn}\", please try again or generate the key first" >&2
    exit 1
fi

revoke_client_certificate(){
    easyrsa revoke "$1"
    echo "Generating the Certificate Revocation List :"
    easyrsa gen-crl
    cp -f "$EASYRSA_PKI/crl.pem" "$OPENVPN/crl.pem"
    chmod 644 "$OPENVPN/crl.pem"
}

revoke_client_certificate "$cn"