implemented some requested changes

api/api.go

@@ -46,7 +46,6 @@ type Authority interface {
 	GetRoots() (federation []*x509.Certificate, err error)
 	GetFederation() ([]*x509.Certificate, error)
 	Version() authority.Version
-	GenerateCertificateRevocationList() error
 	GetCertificateRevocationList() ([]byte, error)
 }
 

api/api_test.go

@@ -580,7 +580,7 @@ type mockAuthority struct {
 	version                      func() authority.Version
 }
 
-func (m *mockAuthority) GenerateCertificateRevocationList(force bool) ([]byte, error) {
+func (m *mockAuthority) GetCertificateRevocationList() ([]byte, error) {
 	panic("implement me")
 }
 

api/crl.go

@@ -4,6 +4,7 @@ import (
 	"encoding/pem"
 	"fmt"
 	"github.com/pkg/errors"
+	"github.com/smallstep/certificates/errs"
 	"net/http"
 )
 
@@ -14,17 +15,16 @@ func (h *caHandler) CRL(w http.ResponseWriter, r *http.Request) {
 	_, formatAsPEM := r.URL.Query()["pem"]
 
 	if err != nil {
-		w.WriteHeader(500)
-		_, err = fmt.Fprintf(w, "%v\n", err)
-		if err != nil {
-			panic(errors.Wrap(err, "error writing http response"))
-		}
+
+		caErr, isCaErr := err.(*errs.Error)
+
+		if isCaErr {
+			http.Error(w, caErr.Msg, caErr.Status)
 			return
 		}
 
-	if crlBytes == nil {
-		w.WriteHeader(404)
-		_, err = fmt.Fprintln(w, "No CRL available")
+		w.WriteHeader(500)
+		_, err = fmt.Fprintf(w, "%v\n", err)
 		if err != nil {
 			panic(errors.Wrap(err, "error writing http response"))
 		}

authority/authority.go

@@ -66,7 +66,7 @@ type Authority struct {
 	sshCAHostFederatedCerts []ssh.PublicKey
 
 	// CRL vars
-	crlChannel chan int
+	crlTicker *time.Ticker
 
 	// Do not re-initialize
 	initOnce  bool
@@ -586,6 +586,10 @@ func (a *Authority) IsAdminAPIEnabled() bool {
 
 // Shutdown safely shuts down any clients, databases, etc. held by the Authority.
 func (a *Authority) Shutdown() error {
+	if a.crlTicker != nil {
+		a.crlTicker.Stop()
+	}
+
 	if err := a.keyManager.Close(); err != nil {
 		log.Printf("error closing the key manager: %v", err)
 	}
@@ -594,6 +598,11 @@ func (a *Authority) Shutdown() error {
 
 // CloseForReload closes internal services, to allow a safe reload.
 func (a *Authority) CloseForReload() {
+
+	if a.crlTicker != nil {
+		a.crlTicker.Stop()
+	}
+
 	if err := a.keyManager.Close(); err != nil {
 		log.Printf("error closing the key manager: %v", err)
 	}
@@ -655,12 +664,12 @@ func (a *Authority) startCRLGenerator() error {
 	if tickerDuration <= 0 {
 		panic(fmt.Sprintf("ERROR: Addition of jitter to CRL generation time %v creates a negative duration (%v). Use a CRL generation time of longer than 1 minute.", a.config.CRL.CacheDuration, tickerDuration))
 	}
-	crlTicker := time.NewTicker(tickerDuration)
+	a.crlTicker = time.NewTicker(tickerDuration)
 
 	go func() {
 		for {
 			select {
-			case <-crlTicker.C:
+			case <-a.crlTicker.C:
 				log.Println("Regenerating CRL")
 				err := a.GenerateCertificateRevocationList()
 				if err != nil {

authority/tls.go

@@ -365,6 +365,7 @@ func (a *Authority) Revoke(ctx context.Context, revokeOpts *RevokeOptions) error
 		err error
 	)
 
+	if revokeOpts.Crt == nil {
 		// Attempt to get the certificate expiry using the serial number.
 		cert, err := a.db.GetCertificate(revokeOpts.Serial)
 
@@ -373,6 +374,7 @@ func (a *Authority) Revoke(ctx context.Context, revokeOpts *RevokeOptions) error
 		if err == nil {
 			rci.ExpiresAt = cert.NotAfter
 		}
+	}
 
 	// If not mTLS then get the TokenID of the token.
 	if !revokeOpts.MTLS {

db/db.go

@@ -215,13 +215,15 @@ func (db *DB) GetRevokedCertificates() (*[]RevokedCertificateInfo, error) {
 		return nil, err
 	}
 	var revokedCerts []RevokedCertificateInfo
+	now := time.Now().UTC()
+
 	for _, e := range entries {
 		var data RevokedCertificateInfo
 		if err := json.Unmarshal(e.Value, &data); err != nil {
 			return nil, err
 		}
 
-		if !data.ExpiresAt.IsZero() && data.ExpiresAt.After(time.Now().UTC()) {
+		if !data.ExpiresAt.IsZero() && data.ExpiresAt.After(now) {
 			revokedCerts = append(revokedCerts, data)
 		} else if data.ExpiresAt.IsZero() {
 			cert, err := db.GetCertificate(data.Serial)
@@ -232,7 +234,7 @@ func (db *DB) GetRevokedCertificates() (*[]RevokedCertificateInfo, error) {
 				continue
 			}
 
-			if cert.NotAfter.After(time.Now().UTC()) {
+			if cert.NotAfter.After(now) {
 				revokedCerts = append(revokedCerts, data)
 			}
 		}