pki.util.crl
============

.. py:module:: pki.util.crl

.. autoapi-nested-parse::

   Utilities for Certificate Revocation List (CRL) generation and management.





Module Contents
---------------

.. py:function:: generate_empty_crl(ca_cert, private_key, hash_algorithm = None, crl_validity_hours = 2400, crl_number = 1)

   Generate an empty CRL for a CA.

   :param ca_cert: The CA certificate.
   :param private_key: The private key of the CA.
   :param hash_algorithm: The hash algorithm to use. Defaults to SHA256.
   :param crl_validity_hours: Validity period in hours.
   :param crl_number: The CRL number to use.

   :returns: The CRL in PEM format.
   :rtype: str


.. py:function:: generate_crl_with_revoked_certs(issuing_ca, crl_validity_hours = 24)

   Generate a CRL with revoked certificates for an issuing CA.

   :param issuing_ca: The issuing CA model instance.
   :param crl_validity_hours: Hours until the next CRL update (nextUpdate field).

   :returns: The generated CRL.
   :rtype: CertificateRevocationList

   :raises AttributeError: If called on a keyless CA.
   :raises ValueError: If credential is None for issuing CA.
   :raises TypeError: If hash algorithm is not allowed.