7
66%
master: 66%

Ran 16 Sep 2019 08:52PM UTC

Files 107

Run time 9s

Badge

Embed ▾

Committed 16 Sep 2019 08:40PM UTC coverage: 60.954% (-0.2%) from 61.171%

Job # RUN="coverage" CONTAINER="netaccess"

Build Type

push

travis-ci

Committed by

web-flow

Commit Message

WFE2: allow revocation of precertificates. (#4433)

When the `features.PrecertificateRevocation` feature flag is enabled the WFE2
will allow revoking certificates for a submitted precertificate. The legacy WFE1
behaviour remains unchanged (as before (pre)certificates issued through the V1
API will be revocable with the V2 API).

Previously the WFE2 vetted the certificate from the revocation request by
looking up a final certificate by the serial number in the requested
certificate, and then doing a byte for byte comparison between the stored and
requested certificate.

Rather than adjust this logic to handle looking up and comparing stored
precertificates against requested precertificates (requiring new RPCs and an
additional round-trip) we choose to instead check the signature on the requested
certificate or precertificate and consider it valid for revocation if the
signature validates with one of the WFE2's known issuers. We trust the integrity
of our own signatures.

An integration test that performs a revocation of a precertificate (in this case
one that never had a final certificate issued due to SCT embedded errors) with
all of the available authentication mechanisms is included.

Resolves https://github.com/letsencrypt/boulder/issues/4414

Run Details

11619 of 19062 relevant lines covered (60.95%)

0.68 hits per line

letsencrypt / boulder / 11185 / 7
66%
master: 66%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job 11185.7 (RUN="coverage" CONTAINER="netaccess")

letsencrypt / boulder / 11185 / 7 66% master: 66%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job 11185.7 (RUN="coverage" CONTAINER="netaccess")

letsencrypt / boulder / 11185 / 7
66%
master: 66%

README BADGES
x