When signing your certificate, use the
extfile option, where you should specify a file containing something like the following:
To get to that, instead of creating a certificate directly with openssl, create a csr (use the
-new option with
openssl req) and key, then generate the certificate following this example (using your own filenames and parameters, if desired):
openssl x509 -req -in cert.csr -out cert.pem -signkey key.pem -extfile crlfile.ext
You can verify the end result with:
openssl x509 -in cert.pem -noout -text
As a side note, this doesn't make sense to improve security. Such a CRL would need to be signed with the same key as the certificate, so that if the key is compromised, a new, clean, crl can be created and considered valid from the same compromised key.
To create a CRL with openssl you are supposed to use its CA functions, as described here. The difference would be that the CA key would be your cert key, and the revoked cert would be the certificate itself. As you can see, this was not supposed to work this way, even if you end up with a self signed certificate with a CDP, and a "valid" crl that is, actually, invalidating itself as by revoking the certificate that signed it.