Add possibility for Sub-CA to be revoked, Removed auto-creation of empty crl for revokecertificate call with CA #3547
Conversation
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #3547 +/- ##
==========================================
+ Coverage 51.86% 57.76% +5.89%
==========================================
Files 370 359 -11
Lines 78618 75151 -3467
Branches 13650 13276 -374
==========================================
+ Hits 40779 43411 +2632
+ Misses 33705 27578 -6127
- Partials 4134 4162 +28 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
| { | ||
| certificateCollection.Add(certificate); | ||
| } | ||
| certificateCollection.Add(certificate); |
There was a problem hiding this comment.
maybe we should throw here when the certificate is 'self-signed' (root-CA) or back to the comfort and just provide the CRL without the root cert ?
There was a problem hiding this comment.
yeah please throw when it is a self signed cert, it makes not sense to revoke in this case.
| using System.Threading.Tasks; | ||
| using Microsoft.Extensions.Logging; | ||
| using Opc.Ua.Security.Certificates; | ||
| using Org.BouncyCastle.Asn1.Cmp; |
There was a problem hiding this comment.
No dependency on BouncyCastle except for netframework. This needs to be done using .net APIs.
| /// <param name="ct">Cancellation token</param> | ||
| /// <returns>Crl for the CA Certificate</returns> | ||
| /// <exception cref="ArgumentException">Non-CA certificates or when no store is provided</exception> | ||
| public static async Task<X509CRL> LoadCrlCreateEmptyIfNonExistantAsync( |
There was a problem hiding this comment.
this method is only called by tests and not used by the GDS Library, not so shure what to think about that.
3 participants
Proposed changes
Describe the changes here to communicate to the maintainers why we should accept this pull request. If it fixes a bug or resolves a feature request, be sure to link to that issue.
Related Issues
Types of changes
What types of changes does your code introduce?
Put an
xin the boxes that apply. You can also fill these out after creating the PR.Checklist
Put an
xin the boxes that apply. You can also fill these out after creating the PR. If you're unsure about any of them, don't hesitate to ask. We're here to help! This is simply a reminder of what we are going to look for before merging your code.Further comments
If we do want to keep the comfort with the empty crl creation for cas we could add that if the CA is a root-ca but I am not sure that this is great behaviour to have that 'different handling'.
If this is a relatively large or complex change, kick off the discussion by explaining why you chose the solution you did and what alternatives you considered, etc...