Actionable Events (CRL Generation)

[DConcord]

I have an OCSP server that uses CRL file as input. Is there a way to monitor that step-ca has generated a new CRL (either because a certificate has recently been revoked or the "renewPeriod" has expired, etc) so that I can trigger a script/action based on that event and pull the new CRL?

[maraino]

The only way I can think of is for you to request it from time to time and look at the CRL number.

[DConcord]

Right, I do have that setup currently and honestly that will end up being "good enough". We all know CRL/OCSP is broken anyway and that short-lived certs drastically reduces the need for revocation... so if I ever have an actual need to revoke, I can just trigger a manual CRL pull for my OCSP server. I do see system logging for "revoke" actions that I could monitor and setup a separate trigger to pull new CRL after that event is observed. Some kind of logging within the GenerateCertificateRevocationList() function would definitely do the trick. But I'm likely being overly OCD. thanks!