1cd9733c24
When the `features.PrecertificateRevocation` feature flag is enabled the WFE2 will allow revoking certificates for a submitted precertificate. The legacy WFE1 behaviour remains unchanged (as before (pre)certificates issued through the V1 API will be revocable with the V2 API). Previously the WFE2 vetted the certificate from the revocation request by looking up a final certificate by the serial number in the requested certificate, and then doing a byte for byte comparison between the stored and requested certificate. Rather than adjust this logic to handle looking up and comparing stored precertificates against requested precertificates (requiring new RPCs and an additional round-trip) we choose to instead check the signature on the requested certificate or precertificate and consider it valid for revocation if the signature validates with one of the WFE2's known issuers. We trust the integrity of our own signatures. An integration test that performs a revocation of a precertificate (in this case one that never had a final certificate issued due to SCT embedded errors) with all of the available authentication mechanisms is included. Resolves https://github.com/letsencrypt/boulder/issues/4414 |
||
|---|---|---|
| .. | ||
| ca.go | ||
| mocks.go | ||