mcp-security-framework 0.1.0__py3-none-any.whl → 1.1.1__py3-none-any.whl

mcp_security_framework/core/cert_manager.py

@@ -43,8 +43,8 @@ from mcp_security_framework.schemas.config import (
     CAConfig,
     CertificateConfig,
     ClientCertConfig,
-    ServerCertConfig,
     IntermediateCAConfig,
+    ServerCertConfig,
 )
 from mcp_security_framework.schemas.models import (
     CertificateInfo,
@@ -60,6 +60,10 @@ from mcp_security_framework.utils.cert_utils import (
     parse_certificate,
     validate_certificate_chain,
 )
+from mcp_security_framework.utils.datetime_compat import (
+    get_not_valid_after_utc,
+    get_not_valid_before_utc,
+)
 
 
 class CertificateManager:
@@ -313,8 +317,8 @@ class CertificateManager:
                 serial_number=str(certificate.serial_number),
                 common_name=ca_config.common_name,
                 organization=ca_config.organization,
-                not_before=certificate.not_valid_before,
-                not_after=certificate.not_valid_after.replace(tzinfo=timezone.utc),
+                not_before=get_not_valid_before_utc(certificate),
+                not_after=get_not_valid_after_utc(certificate),
                 certificate_type=CertificateType.ROOT_CA,
                 key_size=ca_config.key_size,
             )
@@ -340,7 +344,9 @@ class CertificateManager:
                 f"Failed to create root CA certificate: {str(e)}"
             )
 
-    def create_intermediate_ca(self, intermediate_config: IntermediateCAConfig) -> CertificatePair:
+    def create_intermediate_ca(
+        self, intermediate_config: IntermediateCAConfig
+    ) -> CertificatePair:
         """
         Create intermediate CA certificate signed by parent CA.
 
@@ -400,32 +406,47 @@ class CertificateManager:
         try:
             # Validate intermediate configuration
             if not intermediate_config.common_name:
-                raise ValueError("Common name is required for intermediate CA certificate")
+                raise ValueError(
+                    "Common name is required for intermediate CA certificate"
+                )
 
-            if not intermediate_config.parent_ca_cert or not intermediate_config.parent_ca_key:
+            if (
+                not intermediate_config.parent_ca_cert
+                or not intermediate_config.parent_ca_key
+            ):
                 raise ValueError("Parent CA certificate and key paths are required")
 
             # Load parent CA certificate and private key
             if not os.path.exists(intermediate_config.parent_ca_cert):
-                raise FileNotFoundError(f"Parent CA certificate not found: {intermediate_config.parent_ca_cert}")
+                raise FileNotFoundError(
+                    f"Parent CA certificate not found: {intermediate_config.parent_ca_cert}"
+                )
 
             if not os.path.exists(intermediate_config.parent_ca_key):
-                raise FileNotFoundError(f"Parent CA private key not found: {intermediate_config.parent_ca_key}")
+                raise FileNotFoundError(
+                    f"Parent CA private key not found: {intermediate_config.parent_ca_key}"
+                )
 
             with open(intermediate_config.parent_ca_cert, "rb") as f:
                 parent_ca_cert = x509.load_pem_x509_certificate(f.read())
 
             with open(intermediate_config.parent_ca_key, "rb") as f:
-                parent_ca_key = serialization.load_pem_private_key(f.read(), password=None)
+                parent_ca_key = serialization.load_pem_private_key(
+                    f.read(), password=None
+                )
 
             # Generate intermediate CA private key
             private_key = rsa.generate_private_key(
-                public_exponent=65537, key_size=intermediate_config.key_size, backend=None
+                public_exponent=65537,
+                key_size=intermediate_config.key_size,
+                backend=None,
             )
 
             # Create certificate subject
             subject_attributes = [
-                x509.NameAttribute(NameOID.COMMON_NAME, intermediate_config.common_name),
+                x509.NameAttribute(
+                    NameOID.COMMON_NAME, intermediate_config.common_name
+                ),
                 x509.NameAttribute(
                     NameOID.ORGANIZATION_NAME, intermediate_config.organization
                 ),
@@ -434,12 +455,16 @@ class CertificateManager:
 
             if intermediate_config.state:
                 subject_attributes.append(
-                    x509.NameAttribute(NameOID.STATE_OR_PROVINCE_NAME, intermediate_config.state)
+                    x509.NameAttribute(
+                        NameOID.STATE_OR_PROVINCE_NAME, intermediate_config.state
+                    )
                 )
 
             if intermediate_config.locality:
                 subject_attributes.append(
-                    x509.NameAttribute(NameOID.LOCALITY_NAME, intermediate_config.locality)
+                    x509.NameAttribute(
+                        NameOID.LOCALITY_NAME, intermediate_config.locality
+                    )
                 )
 
             if intermediate_config.email:
@@ -457,7 +482,8 @@ class CertificateManager:
             builder = builder.serial_number(x509.random_serial_number())
             builder = builder.not_valid_before(datetime.now(timezone.utc))
             builder = builder.not_valid_after(
-                datetime.now(timezone.utc) + timedelta(days=intermediate_config.validity_years * 365)
+                datetime.now(timezone.utc)
+                + timedelta(days=intermediate_config.validity_years * 365)
             )
 
             # Add CA extensions
@@ -487,7 +513,9 @@ class CertificateManager:
 
             # Add Authority Key Identifier
             builder = builder.add_extension(
-                x509.AuthorityKeyIdentifier.from_issuer_public_key(parent_ca_key.public_key()),
+                x509.AuthorityKeyIdentifier.from_issuer_public_key(
+                    parent_ca_key.public_key()
+                ),
                 critical=False,
             )
 
@@ -527,15 +555,17 @@ class CertificateManager:
             cert_pair = CertificatePair(
                 certificate_path=cert_path,
                 private_key_path=key_path,
-                certificate_pem=certificate.public_bytes(serialization.Encoding.PEM).decode(),
+                certificate_pem=certificate.public_bytes(
+                    serialization.Encoding.PEM
+                ).decode(),
                 private_key_pem=private_key.private_bytes(
                     encoding=serialization.Encoding.PEM,
                     format=serialization.PrivateFormat.PKCS8,
                     encryption_algorithm=serialization.NoEncryption(),
                 ).decode(),
                 serial_number=str(certificate.serial_number),
-                not_before=certificate.not_valid_before.replace(tzinfo=timezone.utc),
-                not_after=certificate.not_valid_after.replace(tzinfo=timezone.utc),
+                not_before=get_not_valid_before_utc(certificate),
+                not_after=get_not_valid_after_utc(certificate),
                 common_name=intermediate_config.common_name,
                 organization=intermediate_config.organization,
                 certificate_type=CertificateType.INTERMEDIATE_CA,
@@ -558,7 +588,10 @@ class CertificateManager:
         except Exception as e:
             self.logger.error(
                 "Failed to create intermediate CA certificate",
-                extra={"intermediate_config": intermediate_config.model_dump(), "error": str(e)},
+                extra={
+                    "intermediate_config": intermediate_config.model_dump(),
+                    "error": str(e),
+                },
             )
             raise CertificateGenerationError(
                 f"Failed to create intermediate CA certificate: {str(e)}"
@@ -775,8 +808,8 @@ class CertificateManager:
                 serial_number=str(certificate.serial_number),
                 common_name=client_config.common_name,
                 organization=client_config.organization,
-                not_before=certificate.not_valid_before,
-                not_after=certificate.not_valid_after.replace(tzinfo=timezone.utc),
+                not_before=get_not_valid_before_utc(certificate),
+                not_after=get_not_valid_after_utc(certificate),
                 certificate_type=CertificateType.CLIENT,
                 key_size=client_config.key_size,
             )
@@ -1009,8 +1042,8 @@ class CertificateManager:
                 serial_number=str(certificate.serial_number),
                 common_name=server_config.common_name,
                 organization=server_config.organization,
-                not_before=certificate.not_valid_before,
-                not_after=certificate.not_valid_after.replace(tzinfo=timezone.utc),
+                not_before=get_not_valid_before_utc(certificate),
+                not_after=get_not_valid_after_utc(certificate),
                 certificate_type=CertificateType.SERVER,
                 key_size=server_config.key_size,
             )
@@ -1038,52 +1071,54 @@ class CertificateManager:
             )
 
     def renew_certificate(
-        self, 
-        cert_path: str, 
+        self,
+        cert_path: str,
         ca_cert_path: Optional[str] = None,
         ca_key_path: Optional[str] = None,
-        validity_years: int = 1
+        validity_years: int = 1,
     ) -> CertificatePair:
         """
         Renew an existing certificate with new validity period.
-        
+
         This method renews a certificate by creating a new certificate
         with the same subject and key but extended validity period.
-        
+
         Args:
             cert_path (str): Path to existing certificate to renew
             ca_cert_path (Optional[str]): Path to CA certificate for signing
             ca_key_path (Optional[str]): Path to CA private key for signing
             validity_years (int): New validity period in years
-            
+
         Returns:
             CertificatePair: New certificate pair with extended validity
-            
+
         Raises:
             CertificateValidationError: When certificate validation fails
             CertificateGenerationError: When renewal fails
         """
         try:
             # Load existing certificate
-            with open(cert_path, 'rb') as f:
+            with open(cert_path, "rb") as f:
                 cert_data = f.read()
-            
+
             cert = x509.load_pem_x509_certificate(cert_data)
-            
+
             # Use provided CA paths or default from config
             ca_cert_file = ca_cert_path or self.config.ca_cert_path
             ca_key_file = ca_key_path or self.config.ca_key_path
-            
+
             if not ca_cert_file or not ca_key_file:
-                raise CertificateConfigurationError("CA certificate and key paths are required")
-            
+                raise CertificateConfigurationError(
+                    "CA certificate and key paths are required"
+                )
+
             # Load CA certificate and key
-            with open(ca_cert_file, 'rb') as f:
+            with open(ca_cert_file, "rb") as f:
                 ca_cert = x509.load_pem_x509_certificate(f.read())
-            
-            with open(ca_key_file, 'rb') as f:
+
+            with open(ca_key_file, "rb") as f:
                 ca_key = serialization.load_pem_private_key(f.read(), password=None)
-            
+
             # Create new certificate with extended validity
             builder = x509.CertificateBuilder()
             builder = builder.subject_name(cert.subject)
@@ -1094,34 +1129,37 @@ class CertificateManager:
             builder = builder.not_valid_after(
                 datetime.now(timezone.utc) + timedelta(days=365 * validity_years)
             )
-            
+
             # Copy extensions from original certificate
             for extension in cert.extensions:
                 if extension.oid not in [x509.ExtensionOID.AUTHORITY_KEY_IDENTIFIER]:
-                    builder = builder.add_extension(extension.value, critical=extension.critical)
-            
+                    builder = builder.add_extension(
+                        extension.value, critical=extension.critical
+                    )
+
             # Sign the certificate
             new_cert = builder.sign(ca_key, hashes.SHA256())
-            
+
             # Generate new file paths
             cert_dir = os.path.dirname(cert_path)
             cert_name = os.path.splitext(os.path.basename(cert_path))[0]
             new_cert_path = os.path.join(cert_dir, f"{cert_name}_renewed.crt")
             new_key_path = os.path.join(cert_dir, f"{cert_name}_renewed.key")
-            
+
             # Save new certificate
-            with open(new_cert_path, 'wb') as f:
+            with open(new_cert_path, "wb") as f:
                 f.write(new_cert.public_bytes(serialization.Encoding.PEM))
-            
+
             # For renewal, we typically keep the same private key
             # Copy the original private key if it exists
-            key_path = cert_path.replace('.crt', '.key').replace('.pem', '.key')
+            key_path = cert_path.replace(".crt", ".key").replace(".pem", ".key")
             private_key_pem = ""
             if os.path.exists(key_path):
                 import shutil
+
                 shutil.copy2(key_path, new_key_path)
                 # Read the private key content
-                with open(key_path, 'r') as f:
+                with open(key_path, "r") as f:
                     private_key_pem = f.read()
             else:
                 # Create a placeholder key file
@@ -1131,46 +1169,51 @@ gVdaZKJR+ym6h3Za4ryK42qlz8Rb5lQICyFJi+h5xqkk71B2ELzu2nzmoafs9OTJ
 LjL4Cwf+OLlI1eRybbU8eqBk8i+B6ALB2FuGjZJplP99fejLMM0L5XNwxJt3OwCx
 WvWwM6xqxW0Sf6s5AxJmTn3amZ0G+aP4Y2AEojlbQR7g5aigKbFQqGDFW07egp6
 -----END PRIVATE KEY-----"""
-                with open(new_key_path, 'w') as f:
+                with open(new_key_path, "w") as f:
                     f.write(placeholder_key)
                 private_key_pem = placeholder_key
-            
+
             # Create certificate pair
             cert_pair = CertificatePair(
                 certificate_path=new_cert_path,
                 private_key_path=new_key_path,
-                certificate_pem=new_cert.public_bytes(serialization.Encoding.PEM).decode(),
+                certificate_pem=new_cert.public_bytes(
+                    serialization.Encoding.PEM
+                ).decode(),
                 private_key_pem=private_key_pem,
                 serial_number=str(new_cert.serial_number),
                 common_name="",  # Will be extracted from subject
                 organization="",  # Will be extracted from subject
-                not_before=new_cert.not_valid_before,
-                not_after=new_cert.not_valid_after.replace(tzinfo=timezone.utc),
+                not_before=get_not_valid_before_utc(new_cert),
+                not_after=get_not_valid_after_utc(new_cert),
                 certificate_type=CertificateType.CLIENT,  # Default
                 key_size=0,  # Will be extracted
             )
-            
+
             self.logger.info(
                 "Certificate renewed successfully",
                 extra={
                     "original_cert": cert_path,
                     "new_cert": new_cert_path,
-                    "validity_years": validity_years
-                }
+                    "validity_years": validity_years,
+                },
             )
-            
+
             return cert_pair
-            
+
         except Exception as e:
             self.logger.error(
                 "Failed to renew certificate",
-                extra={"cert_path": cert_path, "error": str(e)}
+                extra={"cert_path": cert_path, "error": str(e)},
             )
             raise CertificateGenerationError(f"Failed to renew certificate: {str(e)}")
 
     def revoke_certificate(
-        self, serial_number: str, reason: str = "unspecified",
-        ca_cert_path: Optional[str] = None, ca_key_path: Optional[str] = None
+        self,
+        serial_number: str,
+        reason: str = "unspecified",
+        ca_cert_path: Optional[str] = None,
+        ca_key_path: Optional[str] = None,
     ) -> bool:
         """
         Revoke certificate by serial number.
@@ -1211,7 +1254,7 @@ WvWwM6xqxW0Sf6s5AxJmTn3amZ0G+aP4Y2AEojlbQR7g5aigKbFQqGDFW07egp6
             # Use provided CA paths or default from config
             ca_cert_file = ca_cert_path or self.config.ca_cert_path
             ca_key_file = ca_key_path or self.config.ca_key_path
-            
+
             if not ca_cert_file or not ca_key_file:
                 raise CertificateConfigurationError(
                     "CA certificate and key paths are required"
@@ -1235,7 +1278,7 @@ WvWwM6xqxW0Sf6s5AxJmTn3amZ0G+aP4Y2AEojlbQR7g5aigKbFQqGDFW07egp6
             revoked_cert = x509.RevokedCertificateBuilder()
             revoked_cert = revoked_cert.serial_number(int(serial_number))
             revoked_cert = revoked_cert.revocation_date(datetime.now(timezone.utc))
-            
+
             # Build the revoked certificate
             revoked_cert_built = revoked_cert.build()
 
@@ -1247,7 +1290,7 @@ WvWwM6xqxW0Sf6s5AxJmTn3amZ0G+aP4Y2AEojlbQR7g5aigKbFQqGDFW07egp6
             # Save CRL
             crl_filename = "ca_crl.pem"
             crl_path = os.path.join(self.config.cert_storage_path, crl_filename)
-            
+
             # Ensure directory exists
             os.makedirs(os.path.dirname(crl_path), exist_ok=True)
 
@@ -1378,25 +1421,27 @@ WvWwM6xqxW0Sf6s5AxJmTn3amZ0G+aP4Y2AEojlbQR7g5aigKbFQqGDFW07egp6
 
             # Create certificate info
             subject_dict = {}
-            
+
             # Add Common Name
             if cert.subject.get_attributes_for_oid(NameOID.COMMON_NAME):
                 subject_dict["CN"] = str(
                     cert.subject.get_attributes_for_oid(NameOID.COMMON_NAME)[0].value
                 )
-            
+
             # Add Organization
             if cert.subject.get_attributes_for_oid(NameOID.ORGANIZATION_NAME):
                 subject_dict["O"] = str(
-                    cert.subject.get_attributes_for_oid(NameOID.ORGANIZATION_NAME)[0].value
+                    cert.subject.get_attributes_for_oid(NameOID.ORGANIZATION_NAME)[
+                        0
+                    ].value
                 )
-            
+
             # Add Country
             if cert.subject.get_attributes_for_oid(NameOID.COUNTRY_NAME):
                 subject_dict["C"] = str(
                     cert.subject.get_attributes_for_oid(NameOID.COUNTRY_NAME)[0].value
                 )
-            
+
             cert_info = CertificateInfo(
                 subject=subject_dict,
                 issuer={
@@ -1411,8 +1456,8 @@ WvWwM6xqxW0Sf6s5AxJmTn3amZ0G+aP4Y2AEojlbQR7g5aigKbFQqGDFW07egp6
                     )
                 },
                 serial_number=serial_number,
-                not_before=cert.not_valid_before,
-                not_after=cert.not_valid_after,
+                not_before=get_not_valid_before_utc(cert),
+                not_after=get_not_valid_after_utc(cert),
                 certificate_type=CertificateType.CLIENT,  # Default to client, could be enhanced
                 key_size=expiry_info.get("key_size", 2048),  # Default to 2048 bits
                 signature_algorithm=cert.signature_algorithm_oid._name,
@@ -1446,18 +1491,205 @@ WvWwM6xqxW0Sf6s5AxJmTn3amZ0G+aP4Y2AEojlbQR7g5aigKbFQqGDFW07egp6
                 f"Failed to get certificate info: {str(e)}"
             )
 
-    def create_crl(self, ca_cert_path: str, ca_key_path: str, 
-                   output_path: Optional[str] = None, validity_days: int = 30) -> str:
+    def create_certificate_signing_request(
+        self,
+        common_name: str,
+        organization: str,
+        country: str,
+        state: Optional[str] = None,
+        locality: Optional[str] = None,
+        organizational_unit: Optional[str] = None,
+        email: Optional[str] = None,
+        key_size: int = 2048,
+        key_type: str = "rsa",
+        output_path: Optional[str] = None,
+    ) -> Tuple[str, str]:
+        """
+        Create a Certificate Signing Request (CSR).
+
+        This method creates a Certificate Signing Request (CSR) that can be
+        submitted to a Certificate Authority (CA) for signing.
+
+        Args:
+            common_name (str): Common name for the certificate (e.g., domain name)
+            organization (str): Organization name
+            country (str): Country code (e.g., "US", "GB")
+            state (Optional[str]): State or province name
+            locality (Optional[str]): Locality or city name
+            organizational_unit (Optional[str]): Organizational unit name
+            email (Optional[str]): Email address
+            key_size (int): Key size in bits. Defaults to 2048
+            key_type (str): Key type ("rsa" or "ec"). Defaults to "rsa"
+            output_path (Optional[str]): Output directory for CSR and key files.
+                If None, uses default path from configuration
+
+        Returns:
+            Tuple[str, str]: Paths to the created CSR file and private key file
+
+        Raises:
+            ValueError: When required parameters are invalid
+            CertificateGenerationError: When CSR creation fails
+            FileNotFoundError: When output directory is not accessible
+            PermissionError: When output directory is not writable
+
+        Example:
+            >>> cert_manager = CertificateManager(config)
+            >>> csr_path, key_path = cert_manager.create_certificate_signing_request(
+            ...     common_name="api.example.com",
+            ...     organization="Example Corp",
+            ...     country="US",
+            ...     state="California"
+            ... )
+            >>> print(f"CSR created: {csr_path}")
+            >>> print(f"Private key created: {key_path}")
+        """
+        try:
+            # Validate required parameters
+            if not common_name:
+                raise ValueError("Common name is required")
+            if not organization:
+                raise ValueError("Organization is required")
+            if not country:
+                raise ValueError("Country is required")
+
+            # Generate private key
+            if key_type.lower() == "rsa":
+                private_key = rsa.generate_private_key(
+                    public_exponent=65537, key_size=key_size, backend=None
+                )
+            elif key_type.lower() == "ec":
+                private_key = ec.generate_private_key(ec.SECP256R1(), backend=None)
+            else:
+                raise ValueError(f"Unsupported key type: {key_type}")
+
+            # Create CSR subject
+            subject_attributes = [
+                x509.NameAttribute(NameOID.COMMON_NAME, common_name),
+                x509.NameAttribute(NameOID.ORGANIZATION_NAME, organization),
+                x509.NameAttribute(NameOID.COUNTRY_NAME, country),
+            ]
+
+            # Add optional attributes
+            if state:
+                subject_attributes.append(
+                    x509.NameAttribute(NameOID.STATE_OR_PROVINCE_NAME, state)
+                )
+            if locality:
+                subject_attributes.append(
+                    x509.NameAttribute(NameOID.LOCALITY_NAME, locality)
+                )
+            if organizational_unit:
+                subject_attributes.append(
+                    x509.NameAttribute(
+                        NameOID.ORGANIZATIONAL_UNIT_NAME, organizational_unit
+                    )
+                )
+            if email:
+                subject_attributes.append(
+                    x509.NameAttribute(NameOID.EMAIL_ADDRESS, email)
+                )
+
+            subject = x509.Name(subject_attributes)
+
+            # Create CSR builder
+            csr_builder = x509.CertificateSigningRequestBuilder()
+            csr_builder = csr_builder.subject_name(subject)
+            csr_builder = csr_builder.add_extension(
+                x509.BasicConstraints(ca=False, path_length=None), critical=True
+            )
+
+            # Add Subject Alternative Name extension if common name looks like a domain
+            if "." in common_name and not common_name.startswith("*"):
+                san_extension = x509.SubjectAlternativeName([x509.DNSName(common_name)])
+                csr_builder = csr_builder.add_extension(san_extension, critical=False)
+
+            # Build and sign CSR
+            csr = csr_builder.sign(private_key, hashes.SHA256())
+
+            # Determine output paths
+            if output_path is None:
+                output_dir = Path(self.config.cert_storage_path) / "csr"
+                output_dir.mkdir(parents=True, exist_ok=True)
+                timestamp = datetime.now().strftime("%Y%m%d_%H%M%S")
+                csr_filename = f"{common_name.replace('.', '_')}_{timestamp}.csr"
+                key_filename = f"{common_name.replace('.', '_')}_{timestamp}.key"
+                csr_path = str(output_dir / csr_filename)
+                key_path = str(output_dir / key_filename)
+            else:
+                output_dir = Path(output_path)
+                output_dir.mkdir(parents=True, exist_ok=True)
+                timestamp = datetime.now().strftime("%Y%m%d_%H%M%S")
+                csr_filename = f"{common_name.replace('.', '_')}_{timestamp}.csr"
+                key_filename = f"{common_name.replace('.', '_')}_{timestamp}.key"
+                csr_path = str(output_dir / csr_filename)
+                key_path = str(output_dir / key_filename)
+
+            # Write CSR to file
+            with open(csr_path, "wb") as f:
+                f.write(csr.public_bytes(serialization.Encoding.PEM))
+
+            # Write private key to file
+            with open(key_path, "wb") as f:
+                f.write(
+                    private_key.private_bytes(
+                        encoding=serialization.Encoding.PEM,
+                        format=serialization.PrivateFormat.PKCS8,
+                        encryption_algorithm=serialization.NoEncryption(),
+                    )
+                )
+
+            # Set proper permissions
+            os.chmod(key_path, 0o600)  # Read/write for owner only
+            os.chmod(csr_path, 0o644)  # Read for all, write for owner
+
+            self.logger.info(
+                "CSR created successfully",
+                extra={
+                    "csr_path": csr_path,
+                    "key_path": key_path,
+                    "common_name": common_name,
+                    "organization": organization,
+                    "key_type": key_type,
+                    "key_size": key_size,
+                },
+            )
+
+            return csr_path, key_path
+
+        except Exception as e:
+            self.logger.error(
+                "Failed to create CSR",
+                extra={
+                    "common_name": common_name,
+                    "organization": organization,
+                    "error": str(e),
+                },
+            )
+            raise CertificateGenerationError(f"Failed to create CSR: {str(e)}")
+
+    def create_crl(
+        self,
+        ca_cert_path: str,
+        ca_key_path: str,
+        revoked_serials: Optional[List[Dict[str, Union[str, int]]]] = None,
+        output_path: Optional[str] = None,
+        validity_days: int = 30,
+    ) -> str:
         """
         Create a Certificate Revocation List (CRL).
 
         This method creates a Certificate Revocation List (CRL) from the CA
         certificate and private key. The CRL contains information about
-        revoked certificates.
+        revoked certificates with revocation reasons.
 
         Args:
             ca_cert_path (str): Path to CA certificate file
             ca_key_path (str): Path to CA private key file
+            revoked_serials (Optional[List[Dict]]): List of revoked certificate serials.
+                Each dict should contain:
+                - "serial": Serial number as string or int
+                - "reason": Revocation reason (optional)
+                - "revocation_date": Revocation date (optional, defaults to now)
             output_path (Optional[str]): Output path for CRL file.
                 If None, uses default path from configuration
             validity_days (int): CRL validity period in days. Defaults to 30
@@ -1471,9 +1703,14 @@ WvWwM6xqxW0Sf6s5AxJmTn3amZ0G+aP4Y2AEojlbQR7g5aigKbFQqGDFW07egp6
 
         Example:
             >>> cert_manager = CertificateManager(config)
+            >>> revoked_serials = [
+            ...     {"serial": "123456789", "reason": "key_compromise"},
+            ...     {"serial": "987654321", "reason": "certificate_hold"}
+            ... ]
             >>> crl_path = cert_manager.create_crl(
             ...     ca_cert_path="/path/to/ca.crt",
             ...     ca_key_path="/path/to/ca.key",
+            ...     revoked_serials=revoked_serials,
             ...     validity_days=30
             ... )
             >>> print(f"CRL created: {crl_path}")
@@ -1482,17 +1719,17 @@ WvWwM6xqxW0Sf6s5AxJmTn3amZ0G+aP4Y2AEojlbQR7g5aigKbFQqGDFW07egp6
             # Validate input files
             if not os.path.exists(ca_cert_path):
                 raise FileNotFoundError(f"CA certificate not found: {ca_cert_path}")
-            
+
             if not os.path.exists(ca_key_path):
                 raise FileNotFoundError(f"CA private key not found: {ca_key_path}")
 
             # Load CA certificate
-            with open(ca_cert_path, 'rb') as f:
+            with open(ca_cert_path, "rb") as f:
                 ca_cert_data = f.read()
             ca_cert = x509.load_pem_x509_certificate(ca_cert_data)
 
             # Load CA private key
-            with open(ca_key_path, 'rb') as f:
+            with open(ca_key_path, "rb") as f:
                 ca_key_data = f.read()
             ca_private_key = serialization.load_pem_private_key(
                 ca_key_data, password=None
@@ -1508,10 +1745,33 @@ WvWwM6xqxW0Sf6s5AxJmTn3amZ0G+aP4Y2AEojlbQR7g5aigKbFQqGDFW07egp6
             crl_builder = crl_builder.next_update(next_update)
             crl_builder = crl_builder.issuer_name(ca_cert.subject)
 
-            # Add revoked certificates (empty for now, can be enhanced)
-            # This is a basic implementation - in a real scenario, you would
-            # load revoked certificates from a database or file
+            # Add revoked certificates
             revoked_certificates = []
+            if revoked_serials:
+                for revoked_info in revoked_serials:
+                    serial = revoked_info.get("serial")
+                    reason = revoked_info.get("reason", "unspecified")
+                    revocation_date = revoked_info.get("revocation_date", now)
+
+                    # Convert serial to int if it's a string
+                    if isinstance(serial, str):
+                        serial = (
+                            int(serial, 16) if serial.startswith("0x") else int(serial)
+                        )
+
+                    # Map reason string to x509 enum
+                    reason_enum = self._get_revocation_reason(reason)
+
+                    # Create revoked certificate entry
+                    revoked_cert = (
+                        x509.RevokedCertificateBuilder()
+                        .serial_number(serial)
+                        .revocation_date(revocation_date)
+                        .add_extension(x509.CRLReason(reason_enum), critical=False)
+                        .build()
+                    )
+
+                    revoked_certificates.append(revoked_cert)
 
             # Build CRL
             crl = crl_builder.sign(ca_private_key, hashes.SHA256())
@@ -1520,13 +1780,15 @@ WvWwM6xqxW0Sf6s5AxJmTn3amZ0G+aP4Y2AEojlbQR7g5aigKbFQqGDFW07egp6
             if output_path is None:
                 output_dir = Path(self.config.cert_storage_path) / "crl"
                 output_dir.mkdir(parents=True, exist_ok=True)
-                output_path = str(output_dir / f"crl_{now.strftime('%Y%m%d_%H%M%S')}.pem")
+                output_path = str(
+                    output_dir / f"crl_{now.strftime('%Y%m%d_%H%M%S')}.pem"
+                )
             else:
                 output_dir = Path(output_path).parent
                 output_dir.mkdir(parents=True, exist_ok=True)
 
             # Write CRL to file
-            with open(output_path, 'wb') as f:
+            with open(output_path, "wb") as f:
                 f.write(crl.public_bytes(serialization.Encoding.PEM))
 
             self.logger.info(
@@ -1534,8 +1796,8 @@ WvWwM6xqxW0Sf6s5AxJmTn3amZ0G+aP4Y2AEojlbQR7g5aigKbFQqGDFW07egp6
                 extra={
                     "crl_path": output_path,
                     "validity_days": validity_days,
-                    "revoked_count": len(revoked_certificates)
-                }
+                    "revoked_count": len(revoked_certificates),
+                },
             )
 
             return output_path
@@ -1546,69 +1808,101 @@ WvWwM6xqxW0Sf6s5AxJmTn3amZ0G+aP4Y2AEojlbQR7g5aigKbFQqGDFW07egp6
                 extra={
                     "ca_cert_path": ca_cert_path,
                     "ca_key_path": ca_key_path,
-                    "error": str(e)
-                }
+                    "error": str(e),
+                },
             )
             raise CertificateGenerationError(f"Failed to create CRL: {str(e)}")
 
-    def export_certificate(self, cert_path: str, format: str = "pem") -> Union[str, bytes]:
+    def _get_revocation_reason(self, reason: str) -> x509.ReasonFlags:
+        """
+        Map reason string to x509.ReasonFlags enum.
+
+        Args:
+            reason (str): Reason string
+
+        Returns:
+            x509.ReasonFlags: Corresponding reason enum
+        """
+        reason_map = {
+            "unspecified": x509.ReasonFlags.unspecified,
+            "key_compromise": x509.ReasonFlags.key_compromise,
+            "ca_compromise": x509.ReasonFlags.ca_compromise,
+            "affiliation_changed": x509.ReasonFlags.affiliation_changed,
+            "superseded": x509.ReasonFlags.superseded,
+            "cessation_of_operation": x509.ReasonFlags.cessation_of_operation,
+            "certificate_hold": x509.ReasonFlags.certificate_hold,
+            "privilege_withdrawn": x509.ReasonFlags.privilege_withdrawn,
+            "aa_compromise": x509.ReasonFlags.aa_compromise,
+        }
+
+        return reason_map.get(reason.lower(), x509.ReasonFlags.unspecified)
+
+    def export_certificate(
+        self, cert_path: str, format: str = "pem"
+    ) -> Union[str, bytes]:
         """
         Export certificate to different formats.
-        
+
         Args:
             cert_path: Path to certificate file
             format: Export format ("pem" or "der")
-            
+
         Returns:
             Certificate content in specified format
         """
         try:
-            with open(cert_path, 'rb') as f:
+            with open(cert_path, "rb") as f:
                 cert_data = f.read()
-            
+
             if format.lower() == "pem":
-                return cert_data.decode('utf-8')
+                return cert_data.decode("utf-8")
             elif format.lower() == "der":
                 # Convert PEM to DER
                 from cryptography import x509
+
                 cert = x509.load_pem_x509_certificate(cert_data)
                 return cert.public_bytes(serialization.Encoding.DER)
             else:
                 raise ValueError(f"Unsupported format: {format}")
-                
+
         except Exception as e:
             self.logger.error(f"Failed to export certificate: {str(e)}")
             raise CertificateGenerationError(f"Failed to export certificate: {str(e)}")
 
-    def export_private_key(self, key_path: str, format: str = "pem") -> Union[str, bytes]:
+    def export_private_key(
+        self, key_path: str, format: str = "pem"
+    ) -> Union[str, bytes]:
         """
         Export private key to different formats.
-        
+
         Args:
             key_path: Path to private key file
             format: Export format ("pem" or "der")
-            
+
         Returns:
             Private key content in specified format
         """
         try:
-            with open(key_path, 'rb') as f:
+            with open(key_path, "rb") as f:
                 key_data = f.read()
-            
+
             if format.lower() == "pem":
-                return key_data.decode('utf-8')
+                return key_data.decode("utf-8")
             elif format.lower() == "der":
                 # Convert PEM to DER
-                from cryptography.hazmat.primitives.serialization import load_pem_private_key
+                from cryptography.hazmat.primitives.serialization import (
+                    load_pem_private_key,
+                )
+
                 key = load_pem_private_key(key_data, password=None)
                 return key.private_bytes(
                     encoding=serialization.Encoding.DER,
                     format=serialization.PrivateFormat.PKCS8,
-                    encryption_algorithm=serialization.NoEncryption()
+                    encryption_algorithm=serialization.NoEncryption(),
                 )
             else:
                 raise ValueError(f"Unsupported format: {format}")
-                
+
         except Exception as e:
             self.logger.error(f"Failed to export private key: {str(e)}")
             raise CertificateGenerationError(f"Failed to export private key: {str(e)}")
@@ -1618,7 +1912,7 @@ WvWwM6xqxW0Sf6s5AxJmTn3amZ0G+aP4Y2AEojlbQR7g5aigKbFQqGDFW07egp6
         # Skip validation if certificate management is disabled
         if not self.config.enabled:
             return
-            
+
         if not self.config.ca_cert_path:
             raise CertificateConfigurationError("CA certificate path is required")