Merge branch 'main' into feat/toggle-user-role

2025-06-28 09:18:42 +02:00 · 2025-06-15 20:37:28 +02:00
parent 3ea4fc51c9 f4aa5a305b
commit 57be251fd3
14 changed files with 118 additions and 39 deletions
--- a/app/src/Controllers/CertificateController.php
+++ b/app/src/Controllers/CertificateController.php
@ -238,16 +238,14 @@ class CertificateController
            exit();
        }

-        // Empêcher la révocation des certificats Root ou Intermédiaires via l'interface
-        if ($cert['type'] === 'root' || $cert['type'] === 'intermediate') {
-            $_SESSION['error'] = $this->langService->__('cert_revoke_error_ca_revocation');
+        // Empêcher la révocation des certificats Root via l'interface
+        if ($cert['type'] === 'root') {
+            $_SESSION['error'] = $this->langService->__('cert_revoke_error_ca_revocation'); // Peut-être une clé dédiée pour root si le message doit être différent
            header('Location: /certificates');
            exit();
        }

-        // Préparer le nom de base du certificat pour le script (sans l'extension .pem)
-        $certBaseName = str_replace('.cert.pem', '.cert', $cert['name']);
-        $functionalPerimeterName = $cert['perimeter_name'];
+        $functionalPerimeterName = $cert['perimeter_name']; // Déjà récupéré plus haut, mais utile ici aussi

        // Vérifier si le certificat n'est pas déjà révoqué dans la DB
        if ($cert['is_revoked']) {
@ -256,29 +254,79 @@ class CertificateController
            exit();
        }

-        // Appeler le script shell de révocation
-        $command = escapeshellcmd(SCRIPTS_PATH . '/revoke_cert.sh') . ' ' .
-                   escapeshellarg($certBaseName) . ' ' .
-                   escapeshellarg($functionalPerimeterName);
+        if ($cert['type'] === 'intermediate') {
+            // Logique de révocation pour les certificats intermédiaires
+            $intermediateCertPath = "/opt/tls/intermediate/" . $functionalPerimeterName . "/certs/" . $cert['name'];
+            $rootCaConfigPath = "/opt/tls/root/openssl.cnf"; // Chemin vers la configuration OpenSSL du CA Racine
+            $rootCaCrlPath = "/opt/tls/root/crl/crl.pem"; // Chemin vers la CRL du CA Racine

-        $this->logService->log('info', "Tentative de révocation du certificat '{$cert['name']}' pour le périmètre '$functionalPerimeterName'. Commande: '$command'", $userId, $ipAddress);
+            // Commande pour révoquer le certificat intermédiaire avec le CA Racine
+            $revokeCmd = sprintf(
+                "openssl ca -batch -config %s -revoke %s",
+                escapeshellarg($rootCaConfigPath),
+                escapeshellarg($intermediateCertPath)
+            );

-        $output = shell_exec($command . ' 2>&1');
+            $this->logService->log('info', "Tentative de révocation du certificat intermédiaire '{$cert['name']}' pour le périmètre '$functionalPerimeterName'. Commande: '$revokeCmd'", $userId, $ipAddress);
+            $outputRevoke = shell_exec($revokeCmd . ' 2>&1');

-        if (strpos($output, "Certificat '$certBaseName' révoqué avec succès.") !== false) {
-            // Mettre à jour le statut du certificat dans la base de données
-            $stmt = $this->db->prepare("UPDATE certificates SET is_revoked = TRUE, revoked_at = NOW() WHERE id = ?");
-            $stmt->execute([$certificateId]);
+            if (strpos($outputRevoke, "Data Base Updated") !== false || strpos($outputRevoke, "Successfully revoked certificate") !== false) {
+                // Commande pour régénérer la CRL du CA Racine
+                $generateCrlCmd = sprintf(
+                    "openssl ca -batch -config %s -gencrl -out %s",
+                    escapeshellarg($rootCaConfigPath),
+                    escapeshellarg($rootCaCrlPath)
+                );
+
+                $this->logService->log('info', "Révocation réussie. Tentative de mise à jour de la CRL du CA Racine. Commande: '$generateCrlCmd'", $userId, $ipAddress);
+                $outputCrl = shell_exec($generateCrlCmd . ' 2>&1');
+
+                // Vérifier si la CRL a été générée et si le fichier existe
+                if ((strpos($outputCrl, "CRL Generated") !== false || strpos($outputCrl, "CRL generated") !== false) && file_exists($rootCaCrlPath)) {
+                    // Mettre à jour le statut du certificat dans la base de données
+                    $stmt_update = $this->db->prepare("UPDATE certificates SET is_revoked = TRUE, revoked_at = NOW() WHERE id = ?");
+                    $stmt_update->execute([$certificateId]);
+
+                    $this->logService->log('info', "Certificat intermédiaire '{$cert['name']}' révoqué et CRL du CA Racine mise à jour.", $userId, $ipAddress);
+                    $_SESSION['success'] = $this->langService->__('cert_revoke_success_intermediate', ['name' => $cert['name']]);
+                } else {
+                    $this->logService->log('error', "Échec de la mise à jour de la CRL du CA Racine pour le cert intermédiaire '{$cert['name']}'. Output CRL: $outputCrl. Output Revoke: $outputRevoke", $userId, $ipAddress);
+                    $_SESSION['error'] = $this->langService->__('cert_revoke_warn_crl_update_failed_intermediate', ['name' => $cert['name']]);
+                }
+            } else {
+                $_SESSION['error'] = $this->langService->__('cert_revoke_error_intermediate', ['name' => $cert['name'], 'output' => htmlspecialchars($outputRevoke)]);
+                $this->logService->log('error', "Échec de la révocation du certificat intermédiaire '{$cert['name']}'. Output: $outputRevoke", $userId, $ipAddress);
+            }
+            header('Location: /certificates');
+            exit();

-            $this->logService->log('info', "Certificat '{$cert['name']}' révoqué et enregistré en DB.", $userId, $ipAddress);
-            $_SESSION['success'] = $this->langService->__('cert_revoke_success');
        } else {
-            $_SESSION['error'] = $this->langService->__('cert_revoke_error', ['output' => htmlspecialchars($output)]);
-            $this->logService->log('error', "Échec révocation certificat '{$cert['name']}': $output", $userId, $ipAddress);
-        }
+            // Logique existante pour les certificats 'simple'
+            $certBaseName = str_replace('.cert.pem', '.cert', $cert['name']);

-        header('Location: /certificates');
-        exit();
+            // Appeler le script shell de révocation
+            $command = escapeshellcmd(SCRIPTS_PATH . '/revoke_cert.sh') . ' ' .
+                       escapeshellarg($certBaseName) . ' ' .
+                       escapeshellarg($functionalPerimeterName);
+
+            $this->logService->log('info', "Tentative de révocation du certificat simple '{$cert['name']}' pour le périmètre '$functionalPerimeterName'. Commande: '$command'", $userId, $ipAddress);
+
+            $output = shell_exec($command . ' 2>&1');
+
+            if (strpos($output, "Certificat '$certBaseName' révoqué avec succès.") !== false) {
+                // Mettre à jour le statut du certificat dans la base de données
+                $stmt_update = $this->db->prepare("UPDATE certificates SET is_revoked = TRUE, revoked_at = NOW() WHERE id = ?");
+                $stmt_update->execute([$certificateId]);
+
+                $this->logService->log('info', "Certificat simple '{$cert['name']}' révoqué et enregistré en DB.", $userId, $ipAddress);
+                $_SESSION['success'] = $this->langService->__('cert_revoke_success');
+            } else {
+                $_SESSION['error'] = $this->langService->__('cert_revoke_error', ['output' => htmlspecialchars($output)]);
+                $this->logService->log('error', "Échec révocation certificat simple '{$cert['name']}': $output", $userId, $ipAddress);
+            }
+            header('Location: /certificates');
+            exit();
+        }
    }

    /**
--- a/app/src/Lang/ar.json
+++ b/app/src/Lang/ar.json
@ -61,7 +61,7 @@
    "cert_create_error": "Auto-translated 'Error creating certificate: {output}' to Arabic",
    "cert_revoke_error_id_missing": "Auto-translated 'Certificate ID missing for revocation.' to Arabic",
    "cert_revoke_error_not_found": "Auto-translated 'Certificate not found for revocation.' to Arabic",
-    "cert_revoke_error_ca_revocation": "Auto-translated 'ROOT and INTERMEDIATE certificates cannot be revoked via the interface for PKI security reasons.' to Arabic",
+    "cert_revoke_error_ca_revocation": "NEEDS TRANSLATION: ROOT certificates cannot be revoked through the interface for PKI security reasons.",
    "cert_revoke_error_already_revoked": "Auto-translated 'This certificate is already revoked.' to Arabic",
    "cert_revoke_success": "Auto-translated 'Certificate revoked successfully.' to Arabic",
    "cert_revoke_error": "Auto-translated 'Error revoking certificate: {output}' to Arabic",
@ -91,4 +91,7 @@
    "remove_admin_status": "Remove Admin",
    "pass_to_admin": "Make Admin",
    "cannot_change_main_admin_role": "Role not modifiable"
+    "cert_revoke_success_intermediate": "NEEDS TRANSLATION: Intermediate certificate '{name}' has been successfully revoked and the Root CA CRL has been updated.",
+    "cert_revoke_warn_crl_update_failed_intermediate": "NEEDS TRANSLATION: Intermediate certificate '{name}' has been revoked, but updating the Root CA CRL encountered an issue. Please contact an administrator.",
+    "cert_revoke_error_intermediate": "NEEDS TRANSLATION: Error revoking intermediate certificate '{name}': {output}"
 }
--- a/app/src/Lang/de.json
+++ b/app/src/Lang/de.json
@ -61,7 +61,7 @@
    "cert_create_error": "Fehler beim Erstellen des Zertifikats: {output}",
    "cert_revoke_error_id_missing": "Zertifikats-ID für den Widerruf fehlt.",
    "cert_revoke_error_not_found": "Zertifikat für den Widerruf nicht gefunden.",
-    "cert_revoke_error_ca_revocation": "ROOT- und INTERMEDIATE-Zertifikate können aus PKI-Sicherheitsgründen nicht über die Schnittstelle widerrufen werden.",
+    "cert_revoke_error_ca_revocation": "NEEDS TRANSLATION: ROOT certificates cannot be revoked through the interface for PKI security reasons.",
    "cert_revoke_error_already_revoked": "Dieses Zertifikat ist bereits widerrufen.",
    "cert_revoke_success": "Zertifikat erfolgreich widerrufen.",
    "cert_revoke_error": "Fehler beim Widerrufen des Zertifikats: {output}",
@ -91,4 +91,7 @@
    "remove_admin_status": "Remove Admin",
    "pass_to_admin": "Make Admin",
    "cannot_change_main_admin_role": "Role not modifiable"
+    "cert_revoke_success_intermediate": "NEEDS TRANSLATION: Intermediate certificate '{name}' has been successfully revoked and the Root CA CRL has been updated.",
+    "cert_revoke_warn_crl_update_failed_intermediate": "NEEDS TRANSLATION: Intermediate certificate '{name}' has been revoked, but updating the Root CA CRL encountered an issue. Please contact an administrator.",
+    "cert_revoke_error_intermediate": "NEEDS TRANSLATION: Error revoking intermediate certificate '{name}': {output}"
 }
--- a/app/src/Lang/en.json
+++ b/app/src/Lang/en.json
@ -61,7 +61,7 @@
    "cert_create_error": "Error creating certificate: {output}",
    "cert_revoke_error_id_missing": "Certificate ID missing for revocation.",
    "cert_revoke_error_not_found": "Certificate not found for revocation.",
-    "cert_revoke_error_ca_revocation": "ROOT and INTERMEDIATE certificates cannot be revoked via the interface for PKI security reasons.",
+    "cert_revoke_error_ca_revocation": "ROOT certificates cannot be revoked through the interface for PKI security reasons.",
    "cert_revoke_error_already_revoked": "This certificate is already revoked.",
    "cert_revoke_success": "Certificate revoked successfully.",
    "cert_revoke_error": "Error revoking certificate: {output}",
@ -91,4 +91,7 @@
    "remove_admin_status": "Remove Admin",
    "pass_to_admin": "Make Admin",
    "cannot_change_main_admin_role": "Role not modifiable"
+    "cert_revoke_success_intermediate": "Intermediate certificate '{name}' has been successfully revoked and the Root CA CRL has been updated.",
+    "cert_revoke_warn_crl_update_failed_intermediate": "Intermediate certificate '{name}' has been revoked, but updating the Root CA CRL encountered an issue. Please contact an administrator.",
+    "cert_revoke_error_intermediate": "Error revoking intermediate certificate '{name}': {output}"
 }
--- a/app/src/Lang/es.json
+++ b/app/src/Lang/es.json
@ -61,7 +61,7 @@
    "cert_create_error": "Error al crear el certificado: {output}",
    "cert_revoke_error_id_missing": "ID de certificado faltante para la revocación.",
    "cert_revoke_error_not_found": "Certificado no encontrado para la revocación.",
-    "cert_revoke_error_ca_revocation": "Los certificados ROOT e INTERMEDIOS no pueden ser revocados a través de la interfaz por razones de seguridad PKI.",
+    "cert_revoke_error_ca_revocation": "NEEDS TRANSLATION: ROOT certificates cannot be revoked through the interface for PKI security reasons.",
    "cert_revoke_error_already_revoked": "Este certificado ya ha sido revocado.",
    "cert_revoke_success": "Certificado revocado correctamente.",
    "cert_revoke_error": "Error al revocar el certificado: {output}",
@ -91,4 +91,7 @@
    "remove_admin_status": "Remove Admin",
    "pass_to_admin": "Make Admin",
    "cannot_change_main_admin_role": "Role not modifiable"
+    "cert_revoke_success_intermediate": "NEEDS TRANSLATION: Intermediate certificate '{name}' has been successfully revoked and the Root CA CRL has been updated.",
+    "cert_revoke_warn_crl_update_failed_intermediate": "NEEDS TRANSLATION: Intermediate certificate '{name}' has been revoked, but updating the Root CA CRL encountered an issue. Please contact an administrator.",
+    "cert_revoke_error_intermediate": "NEEDS TRANSLATION: Error revoking intermediate certificate '{name}': {output}"
 }
--- a/app/src/Lang/fr.json
+++ b/app/src/Lang/fr.json
@ -61,7 +61,7 @@
    "cert_create_error": "Erreur lors de la création du certificat: {output}",
    "cert_revoke_error_id_missing": "ID du certificat manquant pour la révocation.",
    "cert_revoke_error_not_found": "Certificat introuvable pour la révocation.",
-    "cert_revoke_error_ca_revocation": "Les certificats ROOT et INTERMÉDIAIRES ne peuvent pas être révoqués via l'interface pour des raisons de sécurité PKI.",
+    "cert_revoke_error_ca_revocation": "Les certificats ROOT ne peuvent pas être révoqués via l'interface pour des raisons de sécurité PKI.",
    "cert_revoke_error_already_revoked": "Ce certificat est déjà révoqué.",
    "cert_revoke_success": "Certificat révoqué avec succès.",
    "cert_revoke_error": "Erreur lors de la révocation du certificat: {output}",
@ -91,4 +91,7 @@
    "remove_admin_status": "Retirer Admin",
    "pass_to_admin": "Passer Admin",
    "cannot_change_main_admin_role": "Rôle non modifiable"
+    "cert_revoke_success_intermediate": "Le certificat intermédiaire '{name}' a été révoqué avec succès et la CRL du CA Racine a été mise à jour.",
+    "cert_revoke_warn_crl_update_failed_intermediate": "Le certificat intermédiaire '{name}' a été révoqué, mais la mise à jour de la CRL du CA Racine a rencontré un problème. Veuillez contacter un administrateur.",
+    "cert_revoke_error_intermediate": "Erreur lors de la révocation du certificat intermédiaire '{name}': {output}"
 }
--- a/app/src/Lang/hi.json
+++ b/app/src/Lang/hi.json
@ -61,7 +61,7 @@
    "cert_create_error": "Auto-translated 'Error creating certificate: {output}' to Hindi",
    "cert_revoke_error_id_missing": "Auto-translated 'Certificate ID missing for revocation.' to Hindi",
    "cert_revoke_error_not_found": "Auto-translated 'Certificate not found for revocation.' to Hindi",
-    "cert_revoke_error_ca_revocation": "Auto-translated 'ROOT and INTERMEDIATE certificates cannot be revoked via the interface for PKI security reasons.' to Hindi",
+    "cert_revoke_error_ca_revocation": "NEEDS TRANSLATION: ROOT certificates cannot be revoked through the interface for PKI security reasons.",
    "cert_revoke_error_already_revoked": "Auto-translated 'This certificate is already revoked.' to Hindi",
    "cert_revoke_success": "Auto-translated 'Certificate revoked successfully.' to Hindi",
    "cert_revoke_error": "Auto-translated 'Error revoking certificate: {output}' to Hindi",
@ -91,4 +91,7 @@
    "remove_admin_status": "Remove Admin",
    "pass_to_admin": "Make Admin",
    "cannot_change_main_admin_role": "Role not modifiable"
+    "cert_revoke_success_intermediate": "NEEDS TRANSLATION: Intermediate certificate '{name}' has been successfully revoked and the Root CA CRL has been updated.",
+    "cert_revoke_warn_crl_update_failed_intermediate": "NEEDS TRANSLATION: Intermediate certificate '{name}' has been revoked, but updating the Root CA CRL encountered an issue. Please contact an administrator.",
+    "cert_revoke_error_intermediate": "NEEDS TRANSLATION: Error revoking intermediate certificate '{name}': {output}"
 }
--- a/app/src/Lang/it.json
+++ b/app/src/Lang/it.json
@ -61,7 +61,7 @@
    "cert_create_error": "Errore durante la creazione del certificato: {output}",
    "cert_revoke_error_id_missing": "ID certificato mancante per la revoca.",
    "cert_revoke_error_not_found": "Certificato non trovato per la revoca.",
-    "cert_revoke_error_ca_revocation": "I certificati ROOT e INTERMEDIATE non possono essere revocati tramite l'interfaccia per motivi di sicurezza PKI.",
+    "cert_revoke_error_ca_revocation": "NEEDS TRANSLATION: ROOT certificates cannot be revoked through the interface for PKI security reasons.",
    "cert_revoke_error_already_revoked": "Questo certificato è già stato revocato.",
    "cert_revoke_success": "Certificato revocato con successo.",
    "cert_revoke_error": "Errore durante la revoca del certificato: {output}",
@ -91,4 +91,7 @@
    "remove_admin_status": "Remove Admin",
    "pass_to_admin": "Make Admin",
    "cannot_change_main_admin_role": "Role not modifiable"
+    "cert_revoke_success_intermediate": "NEEDS TRANSLATION: Intermediate certificate '{name}' has been successfully revoked and the Root CA CRL has been updated.",
+    "cert_revoke_warn_crl_update_failed_intermediate": "NEEDS TRANSLATION: Intermediate certificate '{name}' has been revoked, but updating the Root CA CRL encountered an issue. Please contact an administrator.",
+    "cert_revoke_error_intermediate": "NEEDS TRANSLATION: Error revoking intermediate certificate '{name}': {output}"
 }
--- a/app/src/Lang/ja.json
+++ b/app/src/Lang/ja.json
@ -61,7 +61,7 @@
    "cert_create_error": "Auto-translated 'Error creating certificate: {output}' to Japanese",
    "cert_revoke_error_id_missing": "Auto-translated 'Certificate ID missing for revocation.' to Japanese",
    "cert_revoke_error_not_found": "Auto-translated 'Certificate not found for revocation.' to Japanese",
-    "cert_revoke_error_ca_revocation": "Auto-translated 'ROOT and INTERMEDIATE certificates cannot be revoked via the interface for PKI security reasons.' to Japanese",
+    "cert_revoke_error_ca_revocation": "NEEDS TRANSLATION: ROOT certificates cannot be revoked through the interface for PKI security reasons.",
    "cert_revoke_error_already_revoked": "Auto-translated 'This certificate is already revoked.' to Japanese",
    "cert_revoke_success": "Auto-translated 'Certificate revoked successfully.' to Japanese",
    "cert_revoke_error": "Auto-translated 'Error revoking certificate: {output}' to Japanese",
@ -91,4 +91,7 @@
    "remove_admin_status": "Remove Admin",
    "pass_to_admin": "Make Admin",
    "cannot_change_main_admin_role": "Role not modifiable"
+    "cert_revoke_success_intermediate": "NEEDS TRANSLATION: Intermediate certificate '{name}' has been successfully revoked and the Root CA CRL has been updated.",
+    "cert_revoke_warn_crl_update_failed_intermediate": "NEEDS TRANSLATION: Intermediate certificate '{name}' has been revoked, but updating the Root CA CRL encountered an issue. Please contact an administrator.",
+    "cert_revoke_error_intermediate": "NEEDS TRANSLATION: Error revoking intermediate certificate '{name}': {output}"
 }
--- a/app/src/Lang/pt.json
+++ b/app/src/Lang/pt.json
@ -61,7 +61,7 @@
    "cert_create_error": "Erro ao criar certificado: {output}",
    "cert_revoke_error_id_missing": "ID do certificado em falta para revogação.",
    "cert_revoke_error_not_found": "Certificado não encontrado para revogação.",
-    "cert_revoke_error_ca_revocation": "Certificados ROOT e INTERMEDIÁRIOS não podem ser revogados através da interface por razões de segurança PKI.",
+    "cert_revoke_error_ca_revocation": "NEEDS TRANSLATION: ROOT certificates cannot be revoked through the interface for PKI security reasons.",
    "cert_revoke_error_already_revoked": "Este certificado já está revogado.",
    "cert_revoke_success": "Certificado revogado com sucesso.",
    "cert_revoke_error": "Erro ao revogar certificado: {output}",
@ -91,4 +91,7 @@
    "remove_admin_status": "Remove Admin",
    "pass_to_admin": "Make Admin",
    "cannot_change_main_admin_role": "Role not modifiable"
+    "cert_revoke_success_intermediate": "NEEDS TRANSLATION: Intermediate certificate '{name}' has been successfully revoked and the Root CA CRL has been updated.",
+    "cert_revoke_warn_crl_update_failed_intermediate": "NEEDS TRANSLATION: Intermediate certificate '{name}' has been revoked, but updating the Root CA CRL encountered an issue. Please contact an administrator.",
+    "cert_revoke_error_intermediate": "NEEDS TRANSLATION: Error revoking intermediate certificate '{name}': {output}"
 }
--- a/app/src/Lang/ru.json
+++ b/app/src/Lang/ru.json
@ -61,7 +61,7 @@
    "cert_create_error": "Auto-translated 'Error creating certificate: {output}' to Russian",
    "cert_revoke_error_id_missing": "Auto-translated 'Certificate ID missing for revocation.' to Russian",
    "cert_revoke_error_not_found": "Auto-translated 'Certificate not found for revocation.' to Russian",
-    "cert_revoke_error_ca_revocation": "Auto-translated 'ROOT and INTERMEDIATE certificates cannot be revoked via the interface for PKI security reasons.' to Russian",
+    "cert_revoke_error_ca_revocation": "NEEDS TRANSLATION: ROOT certificates cannot be revoked through the interface for PKI security reasons.",
    "cert_revoke_error_already_revoked": "Auto-translated 'This certificate is already revoked.' to Russian",
    "cert_revoke_success": "Auto-translated 'Certificate revoked successfully.' to Russian",
    "cert_revoke_error": "Auto-translated 'Error revoking certificate: {output}' to Russian",
@ -91,4 +91,7 @@
    "remove_admin_status": "Remove Admin",
    "pass_to_admin": "Make Admin",
    "cannot_change_main_admin_role": "Role not modifiable"
+    "cert_revoke_success_intermediate": "NEEDS TRANSLATION: Intermediate certificate '{name}' has been successfully revoked and the Root CA CRL has been updated.",
+    "cert_revoke_warn_crl_update_failed_intermediate": "NEEDS TRANSLATION: Intermediate certificate '{name}' has been revoked, but updating the Root CA CRL encountered an issue. Please contact an administrator.",
+    "cert_revoke_error_intermediate": "NEEDS TRANSLATION: Error revoking intermediate certificate '{name}': {output}"
 }
--- a/app/src/Lang/zh.json
+++ b/app/src/Lang/zh.json
@ -61,7 +61,7 @@
    "cert_create_error": "Auto-translated 'Error creating certificate: {output}' to Chinese",
    "cert_revoke_error_id_missing": "Auto-translated 'Certificate ID missing for revocation.' to Chinese",
    "cert_revoke_error_not_found": "Auto-translated 'Certificate not found for revocation.' to Chinese",
-    "cert_revoke_error_ca_revocation": "Auto-translated 'ROOT and INTERMEDIATE certificates cannot be revoked via the interface for PKI security reasons.' to Chinese",
+    "cert_revoke_error_ca_revocation": "NEEDS TRANSLATION: ROOT certificates cannot be revoked through the interface for PKI security reasons.",
    "cert_revoke_error_already_revoked": "Auto-translated 'This certificate is already revoked.' to Chinese",
    "cert_revoke_success": "Auto-translated 'Certificate revoked successfully.' to Chinese",
    "cert_revoke_error": "Auto-translated 'Error revoking certificate: {output}' to Chinese",
@ -91,4 +91,7 @@
    "remove_admin_status": "Remove Admin",
    "pass_to_admin": "Make Admin",
    "cannot_change_main_admin_role": "Role not modifiable"
+    "cert_revoke_success_intermediate": "NEEDS TRANSLATION: Intermediate certificate '{name}' has been successfully revoked and the Root CA CRL has been updated.",
+    "cert_revoke_warn_crl_update_failed_intermediate": "NEEDS TRANSLATION: Intermediate certificate '{name}' has been revoked, but updating the Root CA CRL encountered an issue. Please contact an administrator.",
+    "cert_revoke_error_intermediate": "NEEDS TRANSLATION: Error revoking intermediate certificate '{name}': {output}"
 }
--- a/app/src/Views/certificates/index.php
+++ b/app/src/Views/certificates/index.php
@ -49,8 +49,8 @@ require_once APP_ROOT_DIR . '/src/Views/shared/header.php';
                                    </td>
                                    <td>
                                        <?php
-                                        // Seuls les certificats 'simple' et non révoqués peuvent être révoqués via l'interface
-                                        if (!$cert['is_revoked'] && $cert['type'] === 'simple'): ?>
+                                        // Les certificats 'simple' ou 'intermediate' non révoqués peuvent être révoqués
+                                        if (!$cert['is_revoked'] && ($cert['type'] === 'simple' || $cert['type'] === 'intermediate')): ?>
                                            <form action="/certificates/revoke" method="post" class="inline-form" onsubmit="return confirm('<?= htmlspecialchars($translations['confirm_revoke']) ?>');">
                                                <input type="hidden" name="certificate_id" value="<?= htmlspecialchars($cert['id']) ?>">
                                                <button type="submit" class="button danger-button"><?= htmlspecialchars($translations['revoke_certificate']) ?></button>
--- a/app/src/Views/dashboard/index.php
+++ b/app/src/Views/dashboard/index.php
@ -40,9 +40,7 @@ require_once APP_ROOT_DIR . '/src/Views/shared/header.php';
                        <a href="/certificates/download?type=root&file=ca.cert.pem" class="button">
                            <?= htmlspecialchars($translations['download_certificate_pem'] ?? 'Download Certificate (.pem)') ?>
                        </a>
-                    </p>
-                    <p>
-                        <a href="/certificates/download?type=root&file=ca.key.pem" class="button">
+                        <a href="/certificates/download?type=root&file=ca.key.pem" class="button" style="margin-left: 10px;">
                            <?= htmlspecialchars($translations['download_key_pem'] ?? 'Download Private Key (.key)') ?>
                        </a>
                    </p>