mirror of
https://github.com/smallstep/certificates.git
synced 2024-10-31 03:20:16 +00:00
implemented some requested changes
This commit is contained in:
parent
a607ab189a
commit
53dbe2309b
@ -50,7 +50,6 @@ type Authority interface {
|
||||
GetRoots() ([]*x509.Certificate, error)
|
||||
GetFederation() ([]*x509.Certificate, error)
|
||||
Version() authority.Version
|
||||
GenerateCertificateRevocationList() error
|
||||
GetCertificateRevocationList() ([]byte, error)
|
||||
}
|
||||
|
||||
|
18
api/crl.go
18
api/crl.go
@ -4,6 +4,7 @@ import (
|
||||
"encoding/pem"
|
||||
"fmt"
|
||||
"github.com/pkg/errors"
|
||||
"github.com/smallstep/certificates/errs"
|
||||
"net/http"
|
||||
)
|
||||
|
||||
@ -14,6 +15,14 @@ func (h *caHandler) CRL(w http.ResponseWriter, r *http.Request) {
|
||||
_, formatAsPEM := r.URL.Query()["pem"]
|
||||
|
||||
if err != nil {
|
||||
|
||||
caErr, isCaErr := err.(*errs.Error)
|
||||
|
||||
if isCaErr {
|
||||
http.Error(w, caErr.Msg, caErr.Status)
|
||||
return
|
||||
}
|
||||
|
||||
w.WriteHeader(500)
|
||||
_, err = fmt.Fprintf(w, "%v\n", err)
|
||||
if err != nil {
|
||||
@ -22,15 +31,6 @@ func (h *caHandler) CRL(w http.ResponseWriter, r *http.Request) {
|
||||
return
|
||||
}
|
||||
|
||||
if crlBytes == nil {
|
||||
w.WriteHeader(404)
|
||||
_, err = fmt.Fprintln(w, "No CRL available")
|
||||
if err != nil {
|
||||
panic(errors.Wrap(err, "error writing http response"))
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
if formatAsPEM {
|
||||
pemBytes := pem.EncodeToMemory(&pem.Block{
|
||||
Type: "X509 CRL",
|
||||
|
@ -67,7 +67,7 @@ type Authority struct {
|
||||
sshCAHostFederatedCerts []ssh.PublicKey
|
||||
|
||||
// CRL vars
|
||||
crlChannel chan int
|
||||
crlTicker *time.Ticker
|
||||
|
||||
// Do not re-initialize
|
||||
initOnce bool
|
||||
@ -604,6 +604,10 @@ func (a *Authority) IsAdminAPIEnabled() bool {
|
||||
|
||||
// Shutdown safely shuts down any clients, databases, etc. held by the Authority.
|
||||
func (a *Authority) Shutdown() error {
|
||||
if a.crlTicker != nil {
|
||||
a.crlTicker.Stop()
|
||||
}
|
||||
|
||||
if err := a.keyManager.Close(); err != nil {
|
||||
log.Printf("error closing the key manager: %v", err)
|
||||
}
|
||||
@ -612,6 +616,11 @@ func (a *Authority) Shutdown() error {
|
||||
|
||||
// CloseForReload closes internal services, to allow a safe reload.
|
||||
func (a *Authority) CloseForReload() {
|
||||
|
||||
if a.crlTicker != nil {
|
||||
a.crlTicker.Stop()
|
||||
}
|
||||
|
||||
if err := a.keyManager.Close(); err != nil {
|
||||
log.Printf("error closing the key manager: %v", err)
|
||||
}
|
||||
@ -686,12 +695,12 @@ func (a *Authority) startCRLGenerator() error {
|
||||
if tickerDuration <= 0 {
|
||||
panic(fmt.Sprintf("ERROR: Addition of jitter to CRL generation time %v creates a negative duration (%v). Use a CRL generation time of longer than 1 minute.", a.config.CRL.CacheDuration, tickerDuration))
|
||||
}
|
||||
crlTicker := time.NewTicker(tickerDuration)
|
||||
a.crlTicker = time.NewTicker(tickerDuration)
|
||||
|
||||
go func() {
|
||||
for {
|
||||
select {
|
||||
case <-crlTicker.C:
|
||||
case <-a.crlTicker.C:
|
||||
log.Println("Regenerating CRL")
|
||||
err := a.GenerateCertificateRevocationList()
|
||||
if err != nil {
|
||||
|
@ -409,13 +409,15 @@ func (a *Authority) Revoke(ctx context.Context, revokeOpts *RevokeOptions) error
|
||||
err error
|
||||
)
|
||||
|
||||
// Attempt to get the certificate expiry using the serial number.
|
||||
cert, err := a.db.GetCertificate(revokeOpts.Serial)
|
||||
if revokeOpts.Crt == nil {
|
||||
// Attempt to get the certificate expiry using the serial number.
|
||||
cert, err := a.db.GetCertificate(revokeOpts.Serial)
|
||||
|
||||
// Revocation of a certificate not in the database may be requested, so fill in the expiry only
|
||||
// if we can
|
||||
if err == nil {
|
||||
rci.ExpiresAt = cert.NotAfter
|
||||
// Revocation of a certificate not in the database may be requested, so fill in the expiry only
|
||||
// if we can
|
||||
if err == nil {
|
||||
rci.ExpiresAt = cert.NotAfter
|
||||
}
|
||||
}
|
||||
|
||||
// If not mTLS nor ACME, then get the TokenID of the token.
|
||||
|
6
db/db.go
6
db/db.go
@ -216,13 +216,15 @@ func (db *DB) GetRevokedCertificates() (*[]RevokedCertificateInfo, error) {
|
||||
return nil, err
|
||||
}
|
||||
var revokedCerts []RevokedCertificateInfo
|
||||
now := time.Now().UTC()
|
||||
|
||||
for _, e := range entries {
|
||||
var data RevokedCertificateInfo
|
||||
if err := json.Unmarshal(e.Value, &data); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
if !data.ExpiresAt.IsZero() && data.ExpiresAt.After(time.Now().UTC()) {
|
||||
if !data.ExpiresAt.IsZero() && data.ExpiresAt.After(now) {
|
||||
revokedCerts = append(revokedCerts, data)
|
||||
} else if data.ExpiresAt.IsZero() {
|
||||
cert, err := db.GetCertificate(data.Serial)
|
||||
@ -233,7 +235,7 @@ func (db *DB) GetRevokedCertificates() (*[]RevokedCertificateInfo, error) {
|
||||
continue
|
||||
}
|
||||
|
||||
if cert.NotAfter.After(time.Now().UTC()) {
|
||||
if cert.NotAfter.After(now) {
|
||||
revokedCerts = append(revokedCerts, data)
|
||||
}
|
||||
}
|
||||
|
Loading…
Reference in New Issue
Block a user