Management interface: add /cert-status-by-serial/ endpoint by felixfontein · Pull Request #252 · letsencrypt/pebble

felixfontein · 2019-07-12T21:50:09Z

This adds a /cert-status-by-serial/ endpoint to the management interface. The certificate is identified by its serial number (in hexadecimal). (It can be extracted with OpenSSL via openssl x509 -in cert.pem -noout -text | sed -En 's/.*Serial Number.*\(0x([0-9a-f]+)\)/\1/p'.) The endpoint returns the certificate itself (in PEM format), the serial (hexadecimal) and the revocation status (Valid or Revoked) as JSON.

Example usage:

$ curl -ki https://127.0.0.1:15000/cert-status-by-serial/5ab954d39632fd78
HTTP/2 200 
cache-control: public, max-age=0, no-cache
content-type: application/json; charset=utf-8
link: <https://127.0.0.1:15000/dir>;rel="index"
content-length: 1671
date: Fri, 12 Jul 2019 21:39:24 GMT

{
   "Certificate": "-----BEGIN CERTIFICATE-----\nMIIEVz...tcw=\n-----END CERTIFICATE-----\n",
   "Serial": "5ab954d39632fd78",
   "Status": "Valid"
}

$ curl -ki https://127.0.0.1:15000/cert-status-by-serial/7811e0b42b98cc1c
HTTP/2 200 
cache-control: public, max-age=0, no-cache
content-type: application/json; charset=utf-8
link: <https://127.0.0.1:15000/dir>;rel="index"
content-length: 1728
date: Fri, 12 Jul 2019 22:14:17 GMT

{
   "Certificate": "-----BEGIN CERTIFICATE-----\nMIIEVz...tcw=\n-----END CERTIFICATE-----\n",
   "RevokedAt": "2019-07-13T00:14:13.719654003+02:00",
   "Serial": "7811e0b42b98cc1c",
   "Status": "Revoked"
}

$ curl -ki https://127.0.0.1:15000/cert-status-by-serial/66317d2e02f5d3d6
HTTP/2 200 
cache-control: public, max-age=0, no-cache
content-type: application/json; charset=utf-8
link: <https://127.0.0.1:15000/dir>;rel="index"
content-length: 1740
date: Fri, 12 Jul 2019 22:14:21 GMT

{
   "Certificate": "-----BEGIN CERTIFICATE-----\nMIIEVz...tcw=\n-----END CERTIFICATE-----\n",
   "Reason": 4,
   "RevokedAt": "2019-07-13T00:13:20.418489956+02:00",
   "Serial": "66317d2e02f5d3d6",
   "Status": "Revoked"
}

CC @adferrand

felixfontein · 2019-07-12T21:50:40Z

I forgot: if Pebble doesn't know the certificate, or can't parse the serial as hex, it will return a 404 with no content.

adferrand · 2019-07-12T22:00:54Z

Looks promising!

One interesting thing to get also (to build a complete OCSP responder for instance) would be the date since when the certificate has been revoked on Pebble side. It could be retrieved as a fourth parameter in the JSON response, if the status is Revoked.

I think it is doable to store this date in the revokedCertificatesById map from ca.db.

What do you think of that @felixfontein?

felixfontein · 2019-07-12T22:03:43Z

Yes, that should be doable. I would include a full timestamp and not just a date, though. And also the revocation code used. I'm trying it now...

felixfontein · 2019-07-12T22:18:02Z

Now revocation timestamp and reason are stored with the revoked certificate, and returned by the endpoint (the reason only when available):

$ curl -ki https://127.0.0.1:15000/cert-status-by-serial/7811e0b42b98cc1c
HTTP/2 200 
cache-control: public, max-age=0, no-cache
content-type: application/json; charset=utf-8
link: <https://127.0.0.1:15000/dir>;rel="index"
content-length: 1728
date: Fri, 12 Jul 2019 22:14:17 GMT

{
   "Certificate": "-----BEGIN CERTIFICATE-----\nMIIEVz...tcw=\n-----END CERTIFICATE-----\n",
   "RevokedAt": "2019-07-13T00:14:13.719654003+02:00",
   "Serial": "7811e0b42b98cc1c",
   "Status": "Revoked"
}

$ curl -ki https://127.0.0.1:15000/cert-status-by-serial/66317d2e02f5d3d6
HTTP/2 200 
cache-control: public, max-age=0, no-cache
content-type: application/json; charset=utf-8
link: <https://127.0.0.1:15000/dir>;rel="index"
content-length: 1740
date: Fri, 12 Jul 2019 22:14:21 GMT

{
   "Certificate": "-----BEGIN CERTIFICATE-----\nMIIEVz...tcw=\n-----END CERTIFICATE-----\n",
   "Reason": 4,
   "RevokedAt": "2019-07-13T00:13:20.418489956+02:00",
   "Serial": "66317d2e02f5d3d6",
   "Status": "Revoked"
}

felixfontein · 2019-07-12T22:23:46Z

I changed it a little so that the timestamp is returned in UTC:

    "RevokedAt": "2019-07-12T22:21:05.392675552Z",

felixfontein · 2019-07-12T22:24:37Z

BTW (and unrelated): all requests to the management interface have a Link header for the directory included, but with the wrong port (that of the management interface).

cpu · 2019-07-15T13:29:01Z

BTW (and unrelated): all requests to the management interface have a Link header for the directory

@felixfontein Good catch! #253

I'll try to review this PR in the next couple of days.

felixfontein · 2019-07-20T06:19:51Z

Rebased to remove conflicts with #254.

cpu

Thanks @felixfontein, this is a nice bit of work :-)

I left a few minor comments but I'm happy with the overall design. Thanks again!

README.md

core/types.go

db/memorystore.go

wfe/wfe.go

README.md

felixfontein · 2019-07-22T19:43:58Z

@cpu thanks for your feedback! I hope I've adjusted everything correctly. At least it still works in my tests :)

cpu

Thanks for integrating my last round of feedback @felixfontein. I left a couple of small comments. I think once those are resolved I'm ☑️ on this branch.

README.md

wfe/wfe.go

Co-Authored-By: Daniel McCarney <[email protected]>

cpu

🎉

cpu · 2019-07-26T18:18:26Z

Thanks again @felixfontein. My goal is to cut a new Pebble release that will have this commit and some of the other new work next week (hopefully Monday).

felixfontein · 2019-07-26T20:58:38Z

@cpu thanks again for reviewing and merging! :)

cpu · 2019-07-29T17:52:58Z

My goal is to cut a new Pebble release that will have this commit and some of the other new work next week (hopefully Monday).

https://github.com/letsencrypt/pebble/releases/tag/v2.2.1 🎉

Fixes #486 This moves the GetCertificateBySerial call earlier, which means that call needs to succeed even for revoked certificates. So this also follows up on #252 by keeping revoked certs in the primary certificatesByID map (while still adding them to the revokedCertificatesByID map).

felixfontein added 4 commits July 20, 2019 08:19

Add /cert-status-by-serial/ endpoint for management interface.

6c12617

Document new endpoint.

e79a421

Return more information for revoked certificates.

ad9245c

Export timestamp as UTC.

bf6b045

felixfontein force-pushed the cert-info-endpoint branch from 9a39d1f to bf6b045 Compare July 20, 2019 06:19

cpu suggested changes Jul 22, 2019

View reviewed changes

cpu reviewed Jul 22, 2019

View reviewed changes

README.md Outdated Show resolved Hide resolved

felixfontein added 6 commits July 22, 2019 21:07

Improve documentation.

7e07243

Add remark for hex encoding.

542e320

Invalid hex -> bad request.

13ccb4d

Change query order.

7d16a1a

Improve check.

bd04016

Using anonymous type instead of map.

10af09b

cpu suggested changes Jul 25, 2019

View reviewed changes

README.md Outdated Show resolved Hide resolved

README.md Outdated Show resolved Hide resolved

wfe/wfe.go Outdated Show resolved Hide resolved

felixfontein and others added 3 commits July 26, 2019 09:36

Update README.md

e44f584

Co-Authored-By: Daniel McCarney <[email protected]>

Update README.md

e58cc62

Co-Authored-By: Daniel McCarney <[email protected]>

Use writeJSONResponse.

7ac768d

cpu approved these changes Jul 26, 2019

View reviewed changes

cpu merged commit ddbb755 into letsencrypt:master Jul 26, 2019

felixfontein deleted the cert-info-endpoint branch July 26, 2019 20:58

This was referenced Jul 29, 2019

HTTP Management Interface #74

Open

How can a client get the revocation status of a certificate? #177

Closed

jsha mentioned this pull request Jun 5, 2025

add overriding of ARI response #501

Merged

Conversation

felixfontein commented Jul 12, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

felixfontein commented Jul 12, 2019

Uh oh!

adferrand commented Jul 12, 2019

Uh oh!

felixfontein commented Jul 12, 2019

Uh oh!

felixfontein commented Jul 12, 2019

Uh oh!

felixfontein commented Jul 12, 2019

Uh oh!

felixfontein commented Jul 12, 2019

Uh oh!

cpu commented Jul 15, 2019

Uh oh!

felixfontein commented Jul 20, 2019

Uh oh!

cpu left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

felixfontein commented Jul 22, 2019

Uh oh!

cpu left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cpu left a comment

Choose a reason for hiding this comment

Uh oh!

cpu commented Jul 26, 2019

Uh oh!

felixfontein commented Jul 26, 2019

Uh oh!

cpu commented Jul 29, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

felixfontein commented Jul 12, 2019 •

edited

Loading

cpu commented Jul 29, 2019 •

edited

Loading