Extend X509Crl functionality

[gweisert]

• added two more constructors for Asn1Time
• added X509Revoked constructor which handles allocation and initial data (takes the cert to be revoked as argument)
• extended X509Clr
  • added constructor to create a new crl for a given cert
  • added support for the crl_number extension
  • added function to sign the crl with a given key
  • added function to retrieve entry_count of the crl
  • added function to revoke a given certificate
  • added functions to set both last_updated and next_update times

usage example

use openssl::bn::BigNum;

pub fn main() {
    let crl = include_bytes!("../tests/assets2/ca_ca1.crl");
    let mut crl = openssl::x509::X509Crl::from_pem(crl).unwrap();

    let key = include_bytes!("../tests/assets2/ca_ca1.key");
    let key = openssl::pkey::PKey::private_key_from_pem(key).unwrap();

    let to_revoke = include_bytes!("../tests/assets2/ca1_cert2.cert");
    let to_revoke = openssl::x509::X509::from_pem(to_revoke).unwrap();

    crl.verify(&key).unwrap();
    crl.revoke(&to_revoke).unwrap();
    crl.increment_crl_number().unwrap();
    crl.sign(&key, openssl::hash::MessageDigest::sha256())
        .unwrap();
    crl.verify(&key).unwrap();

    let to_write = crl.to_pem().unwrap();
    std::fs::write("updated_crl.crl", to_write).unwrap();
}

[botovq]

Thanks. Yes, this is OpenSSL 1.1 API. All this should be available since 2.8.1.

I have only looked at the cfg parts.

[mhartmay]

When my PR #2207 is merged, you can change this &X509 to &X509Ref as well.

Suggested change

	pub fn revoke(&mut self, to_revoke: &X509) -> Result<(), ErrorStack> {
	match self.get_by_cert(to_revoke) {
	pub fn revoke(&mut self, to_revoke: &X509Ref) -> Result<(), ErrorStack> {
	match self.get_by_cert(to_revoke) {

[gweisert]

Alright, I will update it once it is merged.

[gweisert]

@botovq do you see any further issues with this PR? (since you haven't approved it yet 😅)