* Prevent revocation of issuers using revokeCert
Similar to the existing behavior, we'll prevent the revocation of
existing issuer certificates from the existing /revoke/:serial endpoint
for now. This is because a serial number alone is not enough information
(in the worst case) to precisely identify an issuer (as intermediates
signed by two separate external (e.g., OpenSSL) CAs using incremental
serial numbers might have the same serial number).
Additionally, we fix revoking certs on performance secondary clusters,
when they've not yet been migrated.
In a separate change, we'll open up a separate code path to revoke
issuers, ensuring we know exactly which issuer is revoked (and which CRL
it should belong on at time of revocation).
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
* Add warning when revoking expired cert
This prevents confusion when a nil response (with no revocation info) is
returned; requesters are informed that the specified certificate has
already expired.
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
575099d085