Revoke a client.crt?

[wmunyan]

Is there a way to revoke a generated client configuration, so that client can no longer be allowed to connect to the OpenDXL broker?

[vkrish-mcafee]

The OpenDXL broker supports revocation but it is a manual process and requires restart of the broker.
Please submit an enhancement request to make this process dynamic.

Steps

1. Create a text file called 'revokedcerts.lst' in the keysore folder in the configuration location
   with similar permissions as the other files in the folder.
   Ex In the Docker image, configuration folders are in the volume mount: /dxlbroker-volume)
2. Add the sha1 of the revoked cert and restart the broker. The client using that cert can no longer connect.

Note: The McAfee Managed Broker does support revocation dynamically without requiring a restart