letsencrypt / boulder / 13256

66%

master: 66%

push

travis-pro

Use IssuerNameID to get issuer from precertificate (#5217)

Today, when issuing a certificate based on a precertificate, we choose
the issuer based on algorithm: we find the precert's algorithm, look
it up in our table mapping algs to issuers, and then issue the final
cert from that issuer.

It is therefore hypothetically possible for the precertificate and
final certificate to be issued from different issuers, if the mapping
of algs to issuers were updated between precert and final cert issuance.
We don't expect this to be possible given Boulder's architecture, but
it could become possible given sufficient refactoring.

This change updates the lookup method to be based on the IssuerNameID,
which is a truncated hash computed across the whole Name field of the
issuer certificate (or equivalently across the Issuer field of the
issued precertificate). This ensures that final issuance will fail,
rather than have different issuers for the precert and final cert.

Part of #5216

8 of 8 new or added lines in 1 file covered. (100.0%)

13231 of 20257 relevant lines covered (65.32%)

0.73 hits per line