Python加密：使用其他吊销的证书更新现有CRL

Question

我正在尝试使用Python加密项目向现有CRL添加其他证书：https://cryptography.io/

查看CRL生成器的docs，我看不到加载现有CRL、使用add_revoked_certificate(revoked_certificate)进行添加，然后放弃CRL的方法。你知道吗

add_revoked_certificate(revoked_certificate)的文档提到：

revoked_certificate – An instance of RevokedCertificate. These can be obtained from an existing CRL or created with RevokedCertificateBuilder.

这让我相信没有现成的方法来更新CRL，但我只是想确保我没有遗漏什么。你知道吗

值得一提的是，我当前的代码如下所示，我插入了伪代码作为我正在尝试做的事情的注释。你知道吗

def revoke_cert(cert_revocation_list_pem, cert_pem):
    # Load CRL
    cert_revocation_list = x509.load_pem_x509_crl(
        cert_revocation_list_pem.encode("ascii"), default_backend()
    )

    # Load cert
    cert = x509.load_pem_x509_certificate(cert_pem.encode("ascii"), default_backend())

    # Create a revoked cert
    builder = x509.RevokedCertificateBuilder()
    builder = builder.revocation_date(datetime.today())
    builder = builder.serial_number(cert.serial_number)
    revoked_cert = builder.build(default_backend())

    # I want to do something like this
    #cert_revocation_list.append(revoked_cert)

    return cert_revocation_list.public_bytes(encoding=serialization.Encoding.PEM)

一如既往，谢谢你的帮助！你知道吗

编辑：

我最后添加了第三个参数来接受要撤销的证书列表。你知道吗

def build_crl(cert_authority_pem, private_key_pem, certs_to_revoke=None):
    # Load our root cert
    root_cert = x509.load_pem_x509_certificate(
        cert_authority_pem.encode("ascii"), default_backend()
    )

    # Load our root key
    root_key = serialization.load_pem_private_key(
        private_key_pem.encode("ascii"), password=None, backend=default_backend()
    )

    builder = x509.CertificateRevocationListBuilder()
    builder = builder.last_update(datetime.today())
    builder = builder.next_update(datetime.today() + timedelta(1, 0, 0))
    builder = builder.issuer_name(root_cert.issuer)
    if certs_to_revoke:
        for revoked_cert in certs_to_revoke:
            builder = builder.add_revoked_certificate(revoked_cert)
    cert_revocation_list = builder.sign(
        private_key=root_key, algorithm=hashes.SHA256(), backend=default_backend()
    )
    return cert_revocation_list.public_bytes(encoding=serialization.Encoding.PEM)