Documentation
¶
Overview ¶
Package revocation records issuance and irreversible revocation and publishes issuer-signed CRL and OCSP status.
Design ¶
The optional registry supplies CA, SCEP, ACME and MDM with a shared status source. Unknown, expired and revoked certificates remain distinct from valid issued certificates. Issuer keys are crypto.Signer values. CRL numbering and signed publication commit under an issuer lock, and revocation marks publication for refresh.
The caller selects revocation policy, publication URLs and lifetimes and must persist issuance before returning certificates. Certificate pinning and account-driven association are separate controls; importing a certificate here creates neither. Certificate hold and remove-from-CRL are unsupported.
References ¶
- https://github.com/deploymenttheory/go-apple-dm/blob/main/docs/research/decisions/0047-enrollment-authentication-and-optional-security-services.md
- RFC 5280 sections 5 and 6; RFC 6960; RFC 8555 section 7.6
- Zentral conf/mdm/docker/nginx/conf.d/zentral-clicertauth.conf
- MicroMDM server/devicecert.go
Index ¶
- Variables
- func ValidReason(reason int) bool
- func WithProvenance(ctx context.Context, p Provenance) context.Context
- type Certificate
- type Issuer
- type Provenance
- type Registry
- func (r *Registry) ByCertificate(ctx context.Context, cert *x509.Certificate) (Certificate, error)
- func (r *Registry) CRL(ctx context.Context, issuer string) ([]byte, error)
- func (r *Registry) Check(ctx context.Context, cert *x509.Certificate) error
- func (r *Registry) Handler(prefix string) http.Handler
- func (r *Registry) Lookup(ctx context.Context, issuer string, serial *big.Int) (Certificate, error)
- func (r *Registry) OCSP(ctx context.Context, issuer string, request []byte) ([]byte, error)
- func (r *Registry) Register(ctx context.Context, issuer string, cert *x509.Certificate, p Provenance) error
- func (r *Registry) Revoke(ctx context.Context, issuer string, serial *big.Int, reason int) error
- type Status
Constants ¶
This section is empty.
Variables ¶
Functions ¶
func ValidReason ¶
ValidReason accepts irreversible RFC 5280 reasons. certificateHold and removeFromCRL are deliberately unsupported because this registry has no unhold.
func WithProvenance ¶
func WithProvenance(ctx context.Context, p Provenance) context.Context
WithProvenance carries issuance context to a CA depot.
Types ¶
type Certificate ¶
type Certificate struct {
Issuer string
Serial string
Fingerprint string
DER []byte
NotBefore, NotAfter time.Time
Status Status
IssuedAt time.Time
RevokedAt time.Time
Reason int
Provenance Provenance
}
Certificate is the durable record of an issuance. DER permits later status publication and import without relying on a live certificate pin.
type Issuer ¶
type Issuer struct {
Certificate *x509.Certificate
Signer crypto.Signer
CRLTTL, CRLRefresh, OCSPTTL time.Duration
}
Issuer includes explicit publication lifetimes. Keep retired issuers configured while their certificates need status responses. Keys must match Certificate.
type Provenance ¶
type Provenance struct {
// Device identifiers are authorization evidence, never issuance credentials.
UDID, Serial string
EnrollmentID string
Source string
AccountID string
Identifiers []string
EnrollmentReference string
}
Provenance records authorization context at issuance; never include credentials.
func ProvenanceFromContext ¶
func ProvenanceFromContext(ctx context.Context) Provenance
ProvenanceFromContext returns issuance context or its zero value.
type Registry ¶
type Registry struct {
Store state.Store
Now func() time.Time
// contains filtered or unexported fields
}
Registry is immutable configuration over shared state.
func (*Registry) ByCertificate ¶
func (r *Registry) ByCertificate(ctx context.Context, cert *x509.Certificate) (Certificate, error)
ByCertificate looks up exact DER, never treating a different certificate with the same subject or serial as the registered identity.
func (*Registry) CRL ¶
CRL returns a currently published CRL, signing a new numbered publication when revoked state changes or refresh is due. Counter and DER commit atomically, so replicas cannot reuse a number for different lists or serve stale local caches.
func (*Registry) Check ¶
Check rejects unknown, revoked and expired certificates. It is independent of pinning and must run before any mutation, command delivery or credential issuance.
func (*Registry) Handler ¶
Handler exposes GET <prefix>/crl/{issuer} and GET/POST <prefix>/ocsp/{issuer}[/base64-request]. Configure these exact URLs in ca.Policy. Certificate administration is intentionally a separate authenticated API.
func (*Registry) OCSP ¶
OCSP signs a response for the requested issuer and serial. Unregistered serials answer Unknown, never Good; the request's issuer hashes must match the route.
func (*Registry) Register ¶
func (r *Registry) Register(ctx context.Context, issuer string, cert *x509.Certificate, p Provenance) error
Register records a certificate before the issuer returns it. Re-importing the same DER is idempotent and cannot clear revocation or change its provenance.
Source Files