luxolus
/
open-vault
2
0
Fork 0
Code Issues 1 Pull Requests Releases Activity

PKI: Do not load revoked certificates if CRL has been disabled (#17385) 

* PKI: Do not load revoked certificates if CRL has been disabled

 - Restore the prior behavior of not reading in all revoked certificates
   if the CRL has been disabled as there might be performance issues
   if a customer had or is still revoking a lot of certificates.

* Add cl
This commit is contained in:
Steven Clark 2022-10-03 10:04:32 -04:00 committed by GitHub
parent 9542cffa65
commit bb1d36f401
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 16 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
builtin/logical/pki/crl_util.go
View File

@ -828,13 +828,19 @@ func buildAnyCRLs(sc *storageContext, forceNew bool, isDelta bool) error {
} }
} }
// Next, we load and parse all revoked certificates. We need to assign var unassignedCerts []pkix.RevokedCertificate
// these certificates to an issuer. Some certificates will not be var revokedCertsMap map[issuerID][]pkix.RevokedCertificate
// assignable (if they were issued by a since-deleted issuer), so we need
// a separate pool for those. // If the CRL is disabled do not bother reading in all the revoked certificates.
unassignedCerts, revokedCertsMap, err := getRevokedCertEntries(sc, issuerIDCertMap, isDelta) if !globalCRLConfig.Disable {
if err != nil { // Next, we load and parse all revoked certificates. We need to assign
return fmt.Errorf("error building CRLs: unable to get revoked certificate entries: %v", err) // these certificates to an issuer. Some certificates will not be
// assignable (if they were issued by a since-deleted issuer), so we need
// a separate pool for those.
unassignedCerts, revokedCertsMap, err = getRevokedCertEntries(sc, issuerIDCertMap, isDelta)
if err != nil {
return fmt.Errorf("error building CRLs: unable to get revoked certificate entries: %v", err)
}
} }
if err := augmentWithRevokedIssuers(issuerIDEntryMap, issuerIDCertMap, revokedCertsMap); err != nil { if err := augmentWithRevokedIssuers(issuerIDEntryMap, issuerIDCertMap, revokedCertsMap); err != nil {

3
changelog/17385.txt Normal file
View File

@ -0,0 +1,3 @@
```release-note:bug
secrets/pki: Do not read revoked certificates from backend when CRL is disabled
```