Jira (PUP-7744) Puppet CA's CRL is prone to duplicate entries

[Josh Cooper (JIRA)]

Title: Message Title

Josh Cooper commented on PUP-7744   Re: Puppet CA's CRL is prone to duplicate entries Sorry, yeah this is a different issue. The puppet node clean command calls puppet cert clean which will revoke already revoked certs: [root@ma9lddhbmxqglv2 ~]# puppet cert generate foobar Notice: Signed certificate request for ca Notice: foobar has a waiting certificate request Notice: Signed certificate request for foobar Notice: Removing file Puppet::SSL::CertificateRequest foobar at '/etc/puppetlabs/puppet/ssl/ca/requests/foobar.pem' Notice: Removing file Puppet::SSL::CertificateRequest foobar at '/etc/puppetlabs/puppet/ssl/certificate_requests/foobar.pem' [root@ma9lddhbmxqglv2 ~]# puppet cert clean foobar Notice: Revoked certificate with serial 2 Notice: Removing file Puppet::SSL::Certificate foobar at '/etc/puppetlabs/puppet/ssl/ca/signed/foobar.pem' Notice: Removing file Puppet::SSL::Certificate foobar at '/etc/puppetlabs/puppet/ssl/certs/foobar.pem' Notice: Removing file Puppet::SSL::Key foobar at '/etc/puppetlabs/puppet/ssl/private_keys/foobar.pem' [root@ma9lddhbmxqglv2 ~]# puppet cert clean foobar Notice: Revoked certificate with serial 2 [root@ma9lddhbmxqglv2 ~]# puppet cert clean foobar Notice: Revoked certificate with serial 2 [root@ma9lddhbmxqglv2 ~]# openssl crl -in /etc/puppetlabs/puppet/ssl/crl.pem -noout -text Certificate Revocation List (CRL): Version 2 (0x1) Signature Algorithm: sha1WithRSAEncryption Issuer: /CN=Puppet CA: ma9lddhbmxqglv2.delivery.puppetlabs.net Last Update: Jun 30 23:21:33 2017 GMT Next Update: Jun 29 23:21:34 2022 GMT CRL extensions: X509v3 Authority Key Identifier: keyid:A3:67:5B:F5:31:E2:CF:5B:C9:81:A4:1E:03:9B:D6:85:31:61:59:57   X509v3 CRL Number: 4 Revoked Certificates: Serial Number: 02 Revocation Date: Jun 30 23:21:19 2017 GMT CRL entry extensions: X509v3 CRL Reason Code: Key Compromise Serial Number: 02 Revocation Date: Jun 30 23:21:30 2017 GMT CRL entry extensions: X509v3 CRL Reason Code: Key Compromise Serial Number: 02 Revocation Date: Jun 30 23:21:32 2017 GMT CRL entry extensions: X509v3 CRL Reason Code: Key Compromise This is probably just a bug in the cert application that it shouldn't revoke already revoked certs (in the CRL). Add Comment   This message was sent by Atlassian JIRA (v6.4.14#64029-sha1:ae256fe) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.