Skip to content

Commit 9701ced

Browse files
aarongableaarongable
committed
RA: delete GenerateOCSP method
1 parent 4aa2a57 commit 9701ced

File tree

7 files changed

+186
-404
lines changed

7 files changed

+186
-404
lines changed

‎cmd/boulder-ra/main.go

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -41,10 +41,13 @@ type Config struct {
4141
SAService *cmd.GRPCClientConfig
4242
VAService *cmd.GRPCClientConfig
4343
CAService *cmd.GRPCClientConfig
44-
OCSPService *cmd.GRPCClientConfig
4544
PublisherService *cmd.GRPCClientConfig
4645
AkamaiPurgerService *cmd.GRPCClientConfig
4746

47+
// Deprecated: TODO(#8349): Remove this when removing the corresponding
48+
// service from the CA.
49+
OCSPService *cmd.GRPCClientConfig
50+
4851
Limiter struct {
4952
// Redis contains the configuration necessary to connect to Redis
5053
// for rate limiting. This field is required to enable rate
@@ -100,7 +103,7 @@ type Config struct {
100103
//
101104
// Deprecated: This field no longer has any effect, all Must-Staple requests
102105
// are rejected.
103-
// TODO(#8177): Remove this field.
106+
// TODO(#8345): Remove this field.
104107
MustStapleAllowList string `validate:"omitempty"`
105108

106109
// GoodKey is an embedded config stanza for the goodkey library.
@@ -192,10 +195,6 @@ func main() {
192195
cmd.FailOnError(err, "Unable to create CA client")
193196
cac := capb.NewCertificateAuthorityClient(caConn)
194197

195-
ocspConn, err := bgrpc.ClientSetup(c.RA.OCSPService, tlsConfig, scope, clk)
196-
cmd.FailOnError(err, "Unable to create CA OCSP client")
197-
ocspc := capb.NewOCSPGeneratorClient(ocspConn)
198-
199198
saConn, err := bgrpc.ClientSetup(c.RA.SAService, tlsConfig, scope, clk)
200199
cmd.FailOnError(err, "Failed to load credentials and create gRPC connection to SA")
201200
sac := sapb.NewStorageAuthorityClient(saConn)
@@ -302,7 +301,6 @@ func main() {
302301
CAAClient: caaClient,
303302
}
304303
rai.CA = cac
305-
rai.OCSP = ocspc
306304
rai.SA = sac
307305

308306
start, err := bgrpc.NewServer(c.RA.GRPC, logger).Add(

‎ra/proto/ra.pb.go

Lines changed: 181 additions & 190 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎ra/proto/ra.proto

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,6 @@ package ra;
44
option go_package = "github.com/letsencrypt/boulder/ra/proto";
55

66
import "core/proto/core.proto";
7-
import "ca/proto/ca.proto";
87
import "google/protobuf/empty.proto";
98
import "google/protobuf/duration.proto";
109

@@ -20,8 +19,6 @@ service RegistrationAuthority {
2019
rpc NewOrder(NewOrderRequest) returns (core.Order) {}
2120
rpc GetAuthorization(GetAuthorizationRequest) returns (core.Authorization) {}
2221
rpc FinalizeOrder(FinalizeOrderRequest) returns (core.Order) {}
23-
// Generate an OCSP response based on the DB's current status and reason code.
24-
rpc GenerateOCSP(GenerateOCSPRequest) returns (ca.OCSPResponse) {}
2522
rpc UnpauseAccount(UnpauseAccountRequest) returns (UnpauseAccountResponse) {}
2623
rpc AddRateLimitOverride(AddRateLimitOverrideRequest) returns (AddRateLimitOverrideResponse) {}
2724
}

‎ra/proto/ra_grpc.pb.go

Lines changed: 0 additions & 41 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎ra/ra.go

Lines changed: 0 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -76,7 +76,6 @@ type RegistrationAuthorityImpl struct {
7676
rapb.UnsafeRegistrationAuthorityServer
7777
rapb.UnsafeSCTProviderServer
7878
CA capb.CertificateAuthorityClient
79-
OCSP capb.OCSPGeneratorClient
8079
VA va.RemoteClients
8180
SA sapb.StorageAuthorityClient
8281
PA core.PolicyAuthority
@@ -2201,45 +2200,6 @@ func (ra *RegistrationAuthorityImpl) DeactivateAuthorization(ctx context.Context
22012200
return &emptypb.Empty{}, nil
22022201
}
22032202

2204-
// GenerateOCSP looks up a certificate's status, then requests a signed OCSP
2205-
// response for it from the CA. If the certificate status is not available
2206-
// or the certificate is expired, it returns berrors.NotFoundError.
2207-
func (ra *RegistrationAuthorityImpl) GenerateOCSP(ctx context.Context, req *rapb.GenerateOCSPRequest) (*capb.OCSPResponse, error) {
2208-
status, err := ra.SA.GetCertificateStatus(ctx, &sapb.Serial{Serial: req.Serial})
2209-
if errors.Is(err, berrors.NotFound) {
2210-
_, err := ra.SA.GetSerialMetadata(ctx, &sapb.Serial{Serial: req.Serial})
2211-
if errors.Is(err, berrors.NotFound) {
2212-
return nil, berrors.UnknownSerialError()
2213-
} else {
2214-
return nil, berrors.NotFoundError("certificate not found")
2215-
}
2216-
} else if err != nil {
2217-
return nil, err
2218-
}
2219-
2220-
// If we get an OCSP query for a certificate where the status is still
2221-
// OCSPStatusNotReady, that means an error occurred, not here but at issuance
2222-
// time. Specifically, we succeeded in storing the linting certificate (and
2223-
// corresponding certificateStatus row), but failed before calling
2224-
// SetCertificateStatusReady. We expect this to be rare, and we expect such
2225-
// certificates not to get OCSP queries, so InternalServerError is appropriate.
2226-
if status.Status == string(core.OCSPStatusNotReady) {
2227-
return nil, errors.New("serial belongs to a certificate that errored during issuance")
2228-
}
2229-
2230-
if ra.clk.Now().After(status.NotAfter.AsTime()) {
2231-
return nil, berrors.NotFoundError("certificate is expired")
2232-
}
2233-
2234-
return ra.OCSP.GenerateOCSP(ctx, &capb.GenerateOCSPRequest{
2235-
Serial: req.Serial,
2236-
Status: status.Status,
2237-
Reason: int32(status.RevokedReason), //nolint: gosec // Revocation reasons are guaranteed to be small, no risk of overflow.
2238-
RevokedAt: status.RevokedDate,
2239-
IssuerID: status.IssuerID,
2240-
})
2241-
}
2242-
22432203
// NewOrder creates a new order object
22442204
func (ra *RegistrationAuthorityImpl) NewOrder(ctx context.Context, req *rapb.NewOrderRequest) (*corepb.Order, error) {
22452205
if req == nil || req.RegistrationID == 0 {

‎ra/ra_test.go

Lines changed: 0 additions & 113 deletions
Original file line numberDiff line numberDiff line change
@@ -388,7 +388,6 @@ func initAuthorities(t *testing.T) (*DummyValidationAuthority, sapb.StorageAutho
388388
ra.SA = sa
389389
ra.VA = va
390390
ra.CA = ca
391-
ra.OCSP = &mocks.MockOCSPGenerator{}
392391
ra.PA = pa
393392
return dummyVA, sa, ra, rlSource, fc, cleanUp
394393
}
@@ -3630,125 +3629,16 @@ func (msar *mockSARevocation) UpdateRevokedCertificate(_ context.Context, req *s
36303629
return &emptypb.Empty{}, nil
36313630
}
36323631

3633-
type mockOCSPA struct {
3634-
mocks.MockCA
3635-
}
3636-
3637-
func (mcao *mockOCSPA) GenerateOCSP(context.Context, *capb.GenerateOCSPRequest, ...grpc.CallOption) (*capb.OCSPResponse, error) {
3638-
return &capb.OCSPResponse{Response: []byte{1, 2, 3}}, nil
3639-
}
3640-
36413632
type mockPurger struct{}
36423633

36433634
func (mp *mockPurger) Purge(context.Context, *akamaipb.PurgeRequest, ...grpc.CallOption) (*emptypb.Empty, error) {
36443635
return &emptypb.Empty{}, nil
36453636
}
36463637

3647-
// mockSAGenerateOCSP is a mock SA that always returns a good OCSP response, with a constant NotAfter.
3648-
type mockSAGenerateOCSP struct {
3649-
sapb.StorageAuthorityClient
3650-
expiration time.Time
3651-
}
3652-
3653-
func (msgo *mockSAGenerateOCSP) GetCertificateStatus(_ context.Context, req *sapb.Serial, _ ...grpc.CallOption) (*corepb.CertificateStatus, error) {
3654-
return &corepb.CertificateStatus{
3655-
Serial: req.Serial,
3656-
Status: "good",
3657-
NotAfter: timestamppb.New(msgo.expiration.UTC()),
3658-
}, nil
3659-
}
3660-
3661-
func TestGenerateOCSP(t *testing.T) {
3662-
_, _, ra, _, clk, cleanUp := initAuthorities(t)
3663-
defer cleanUp()
3664-
3665-
ra.OCSP = &mockOCSPA{}
3666-
ra.SA = &mockSAGenerateOCSP{expiration: clk.Now().Add(time.Hour)}
3667-
3668-
req := &rapb.GenerateOCSPRequest{
3669-
Serial: core.SerialToString(big.NewInt(1)),
3670-
}
3671-
3672-
resp, err := ra.GenerateOCSP(context.Background(), req)
3673-
test.AssertNotError(t, err, "generating OCSP")
3674-
test.AssertByteEquals(t, resp.Response, []byte{1, 2, 3})
3675-
3676-
ra.SA = &mockSAGenerateOCSP{expiration: clk.Now().Add(-time.Hour)}
3677-
_, err = ra.GenerateOCSP(context.Background(), req)
3678-
if !errors.Is(err, berrors.NotFound) {
3679-
t.Errorf("expected NotFound error, got %s", err)
3680-
}
3681-
}
3682-
3683-
// mockSALongExpiredSerial is a mock SA that treats every serial as if it expired a long time ago.
3684-
// Specifically, it returns NotFound to GetCertificateStatus (simulating the serial having been
3685-
// removed from the certificateStatus table), but returns success to GetSerialMetadata (simulating
3686-
// a serial number staying in the `serials` table indefinitely).
3687-
type mockSALongExpiredSerial struct {
3688-
sapb.StorageAuthorityClient
3689-
}
3690-
3691-
func (msgo *mockSALongExpiredSerial) GetCertificateStatus(_ context.Context, req *sapb.Serial, _ ...grpc.CallOption) (*corepb.CertificateStatus, error) {
3692-
return nil, berrors.NotFoundError("not found")
3693-
}
3694-
3695-
func (msgo *mockSALongExpiredSerial) GetSerialMetadata(_ context.Context, req *sapb.Serial, _ ...grpc.CallOption) (*sapb.SerialMetadata, error) {
3696-
return &sapb.SerialMetadata{
3697-
Serial: req.Serial,
3698-
}, nil
3699-
}
3700-
3701-
func TestGenerateOCSPLongExpiredSerial(t *testing.T) {
3702-
_, _, ra, _, _, cleanUp := initAuthorities(t)
3703-
defer cleanUp()
3704-
3705-
ra.OCSP = &mockOCSPA{}
3706-
ra.SA = &mockSALongExpiredSerial{}
3707-
3708-
req := &rapb.GenerateOCSPRequest{
3709-
Serial: core.SerialToString(big.NewInt(1)),
3710-
}
3711-
3712-
_, err := ra.GenerateOCSP(context.Background(), req)
3713-
test.AssertError(t, err, "generating OCSP")
3714-
if !errors.Is(err, berrors.NotFound) {
3715-
t.Errorf("expected NotFound error, got %#v", err)
3716-
}
3717-
}
3718-
3719-
// mockSAUnknownSerial is a mock SA that always returns NotFound to certificate status and serial lookups.
3720-
// It emulates an SA that has never issued a certificate.
3721-
type mockSAUnknownSerial struct {
3722-
mockSALongExpiredSerial
3723-
}
3724-
3725-
func (msgo *mockSAUnknownSerial) GetSerialMetadata(_ context.Context, req *sapb.Serial, _ ...grpc.CallOption) (*sapb.SerialMetadata, error) {
3726-
return nil, berrors.NotFoundError("not found")
3727-
}
3728-
3729-
func TestGenerateOCSPUnknownSerial(t *testing.T) {
3730-
_, _, ra, _, _, cleanUp := initAuthorities(t)
3731-
defer cleanUp()
3732-
3733-
ra.OCSP = &mockOCSPA{}
3734-
ra.SA = &mockSAUnknownSerial{}
3735-
3736-
req := &rapb.GenerateOCSPRequest{
3737-
Serial: core.SerialToString(big.NewInt(1)),
3738-
}
3739-
3740-
_, err := ra.GenerateOCSP(context.Background(), req)
3741-
test.AssertError(t, err, "generating OCSP")
3742-
if !errors.Is(err, berrors.UnknownSerial) {
3743-
t.Errorf("expected UnknownSerial error, got %#v", err)
3744-
}
3745-
}
3746-
37473638
func TestRevokeCertByApplicant_Subscriber(t *testing.T) {
37483639
_, _, ra, _, clk, cleanUp := initAuthorities(t)
37493640
defer cleanUp()
37503641

3751-
ra.OCSP = &mockOCSPA{}
37523642
ra.purger = &mockPurger{}
37533643

37543644
// Use the same self-signed cert as both issuer and issuee for revocation.
@@ -3823,7 +3713,6 @@ func TestRevokeCertByApplicant_Controller(t *testing.T) {
38233713
_, _, ra, _, clk, cleanUp := initAuthorities(t)
38243714
defer cleanUp()
38253715

3826-
ra.OCSP = &mockOCSPA{}
38273716
ra.purger = &mockPurger{}
38283717

38293718
// Use the same self-signed cert as both issuer and issuee for revocation.
@@ -3864,7 +3753,6 @@ func TestRevokeCertByKey(t *testing.T) {
38643753
_, _, ra, _, clk, cleanUp := initAuthorities(t)
38653754
defer cleanUp()
38663755

3867-
ra.OCSP = &mockOCSPA{}
38683756
ra.purger = &mockPurger{}
38693757

38703758
// Use the same self-signed cert as both issuer and issuee for revocation.
@@ -3916,7 +3804,6 @@ func TestAdministrativelyRevokeCertificate(t *testing.T) {
39163804
_, _, ra, _, clk, cleanUp := initAuthorities(t)
39173805
defer cleanUp()
39183806

3919-
ra.OCSP = &mockOCSPA{}
39203807
ra.purger = &mockPurger{}
39213808

39223809
// Use the same self-signed cert as both issuer and issuee for revocation.

‎test/config-next/ra.json

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -92,16 +92,6 @@
9292
"noWaitForReady": true,
9393
"hostOverride": "ca.boulder"
9494
},
95-
"ocspService": {
96-
"dnsAuthority": "consul.service.consul",
97-
"srvLookup": {
98-
"service": "ca",
99-
"domain": "service.consul"
100-
},
101-
"timeout": "15s",
102-
"noWaitForReady": true,
103-
"hostOverride": "ca.boulder"
104-
},
10595
"publisherService": {
10696
"dnsAuthority": "consul.service.consul",
10797
"srvLookup": {

0 commit comments

Comments
 (0)