since.2006  

dir = d:/youpath/ca # Where everything is kept

openssl ca -keyfile d:\path\bin\cert\ca\ca-key.pem -cert d:\path\bin\cert\ca\ca-cert.pem -revoke d:\path\bin\cert\client\client-cert.pem -config d:\path\bin\cert\openssl\openssl.cnf

openssl ca -gencrl -config d:\path\bin\cert\openssl\openssl.cnf -crldays 7 -out d:\path\bin\cert\server\server-cert-list.crl

修改tomcat conf/server.xml 文件，多了个 crlFile 属性

    <CONNECTOR port="8443" protocol="HTTP/1.1" scheme="https" secure="true" 
    crlFile="d:/path/bin/cert/server/server-certlist.crl" truststorePass="123456" truststoreType="JKS" 
    truststoreFile="d:/path/bin/cert/ca/ca.jks" keystorePass="123456"
    keystoreType="PKCS12" keystoreFile="d:/path/bin/cert/server/server.p12" clientAuth="true" sslProtocol="TLS" acceptCount="100"
    disableUploadTimeout="true" enableLookups="false" maxSpareThreads="75" minSpareThreads="25" maxThreads="150" 
    maxHttpHeaderSize="8192" SSLEnabled="true" />

有资料说tomcat中使用撤销证书列表功能，需要编译org.apache.tomcat.util.net.jsse.JSSE15*.java或整个tomcat-util.jar 但在tomcat6中，实际测试时，并不需要编译上述文件，直接添加crlFile到server.xml里，重启服务器即可看到效果。如果用户证书已被撤销，将提交找不到服务器，无法打开页面。