Is your feature request related to a problem? Please describe.
This is for embedded software development.
We use the Vault PKI to sign software releases. Releases themselves are signed by a certificate which has a very short expiration date (hours), since they should not be used for anything else than signing the current release and then the private key is thrown away.
If however we have a software release which is deemed insecure, we use the CRL to block software updates to that version. Since a CVE / security finding can happen at any point in the years (!) to come, we need to be able to revoke an already expired certificate.
Describe the solution you'd like
We would like an optional parameter to the /pki/revoke endpoint which skips the expiration check in crl_util.go.
Alternatively, it might be even better and even easier to augment /pki/config/crl to a boolean option allow_expired_cert_revocation.
Describe alternatives you've considered
Extending the lifetime of the code signing certificate to match the intermediate. However, since also intermediates are rotated on a yearly or 6-months basis, we still have the same issue as any leaf certificate expiration will be bounded by that, and a revocation can happen far later.
We can obviously use /pki/issuer/:issuer_ref/sign-revocation-list and maintain that ourselves.
Else we would need to sign the "CRL" with a detached signature (and handle that in code).
This is a follow-up of https://github.com/hashicorp/vault/issues/19452.
Is your feature request related to a problem? Please describe.
This is for embedded software development.
We use the Vault PKI to sign software releases. Releases themselves are signed by a certificate which has a very short expiration date (hours), since they should not be used for anything else than signing the current release and then the private key is thrown away.
If however we have a software release which is deemed insecure, we use the CRL to block software updates to that version. Since a CVE / security finding can happen at any point in the years (!) to come, we need to be able to revoke an already expired certificate.
Describe the solution you'd like
We would like an optional parameter to the
/pki/revoke
endpoint which skips the expiration check incrl_util.go
.Alternatively, it might be even better and even easier to augment
/pki/config/crl
to a boolean optionallow_expired_cert_revocation
.Describe alternatives you've considered
Extending the lifetime of the code signing certificate to match the intermediate. However, since also intermediates are rotated on a yearly or 6-months basis, we still have the same issue as any leaf certificate expiration will be bounded by that, and a revocation can happen far later.
We can obviously use
/pki/issuer/:issuer_ref/sign-revocation-list
and maintain that ourselves.Else we would need to sign the "CRL" with a detached signature (and handle that in code).
Explain any additional use-cases
See https://github.com/hashicorp/vault/issues/19452.
Additional context
N/A