Include CRL Distribution Point in end-entity certificates #7294
Comments
This was referenced Feb 1, 2024
aarongable
added a commit
that referenced
this issue
Feb 13, 2024
Move the CRL issuance logic -- building an x509.RevocationList template, populating it with correctly-built extensions, linting it, and actually signing it -- out of the //ca package and into the //issuance package. This means that the CA's CRL code no longer needs to be able to reach inside the issuance package to access its issuers and certificates (and those fields will be able to be made private after the same is done for OCSP issuance). Additionally, improve the configuration of CRL issuance, create additional checks on CRL's ThisUpdate and NextUpdate fields, and make it possible for a CRL to contain two IssuingDistributionPoint URIs so that we can migrate to shorter addresses. IN-10045 tracks the corresponding production changes. Fixes #7159 Part of #7296 Part of #7294 Part of #7094 Part of #7100
maksimsavrilov
pushed a commit
to plesk/boulder
that referenced
this issue
Feb 14, 2024
Move the CRL issuance logic -- building an x509.RevocationList template, populating it with correctly-built extensions, linting it, and actually signing it -- out of the //ca package and into the //issuance package. This means that the CA's CRL code no longer needs to be able to reach inside the issuance package to access its issuers and certificates (and those fields will be able to be made private after the same is done for OCSP issuance). Additionally, improve the configuration of CRL issuance, create additional checks on CRL's ThisUpdate and NextUpdate fields, and make it possible for a CRL to contain two IssuingDistributionPoint URIs so that we can migrate to shorter addresses. IN-10045 tracks the corresponding production changes. Fixes letsencrypt#7159 Part of letsencrypt#7296 Part of letsencrypt#7294 Part of letsencrypt#7094 Part of letsencrypt#7100
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Blocked by #7094
Once we have a mechanism to calculate the CRL shard for a given certificate at issuance time, we can use that to actually include the appropriate CRL URL in the certificate's CRL Distribution Point extension.
This will eventually allow us to remove the Authority Information Access OCSP URL, since a different revocation mechanism will be available for all certificates.
Since the configuration item (issuer.CRLURLBase) which controls this URL will be already populated for the sake of the Issuing Distribution Point extension in CRLs themselves, this behavior will need to be gated behind a feature flag.
The text was updated successfully, but these errors were encountered: