anchor.diff:  -spec verify_provider_imp(PeerCertDer :: public_key:der_encoded(),
       CaDir :: string()) -> {ok, ProviderId :: binary()}.
   %% ====================================================================
  -verify_provider_imp(PeerCertDer, CaDir) -> %% @todo: CRLs
  +verify_provider_imp(PeerCertDer, CaDir) ->
       CaCertFile = cacert_path(CaDir),
       {ok, CaCertPem} = file:read_file(CaCertFile),
       [{'Certificate', CaCertDer, not_encrypted}] = public_key:pem_decode(CaCertPem),
  
positive.code:     KeyPath :: string(), Domain :: string()) -> ok.
  %% ====================================================================
  generate_gr_cert(CADir, CertPath, KeyPath, Domain) ->
      TmpDir = mochitemp:mkdtemp(),
      CSRFile = random_filename(TmpDir),
      ReqConfigFile = req_config_file(TmpDir, #dn{commonName = Domain}),
  
negative.code:         " -revoke ", filename:join([CaDir, "newcerts", Serial]), ".pem"]),
      ?info("~s", [RevokeOutput]),
      ?info("Generating an updated CRL"),
      CreateCrlOutput = os:cmd(["openssl ca",
          " -config ", CaConfigFile,
          " -gencrl",
          " -out ", filename:join(CaDir, "crl.pem")]),
      ?info("~s", [CreateCrlOutput]),
      ok.
  
  
  