Revoking a certificate does not work

[OliverSCE]

Revoking a certificate in the gui does not work (nothing happens)

LabCA log states: "'use admin -config path/to/cfg.json revoke-cert -serial deadbeef -reason X instead'"

which seems to be a boulder error message about a malformed argument string in the revoke command.

The certificate to be revoked is one which was issued for the labca sever itself, but is not in use any more. Just in case this matters...

[OliverSCE]

Just verified: I also doesn't work with any other certificate.

[hakwerk]

I haven't tested it myself yet, but probably the fix is to change this line in /home/labca/labca/commander from

docker compose exec boulder bin/admin-revoker serial-revoke --config labca/config/admin-revoker.json $serial $reasonCode 2>&1

to

docker compose exec boulder bin/admin -config labca/config/admin.json revoke-cert -serial $serial -reason $reasonCode 2>&1

[OliverSCE]

The error message changes now. It first gives a server error, an the labca log states:

2024-07-09T16:22:53.924487+00:00Z admin[1008]: 3 admin ntOk6wg [AUDIT] executing subcommand: got unacceptable revocation reason "5" gui-1 | 2024-07-09T16:22:53.924457+00:00Z admin[1008]: 6 admin gqfPqws [AUDIT] admin tool executing a dry-run with the following arguments: "bin/admin -config labca/config/admin.json revoke-cert -serial 7fb2d308a535cc7d5453b2c40fcd2456d364 -reason 5"

[OliverSCE]

Update: hardcoding the reason "superseeded" into the command does seems to be ok, but only does a dry run:

gui-1 | 2024-07-09T16:29:07.703065+00:00Z admin[1022]: 6 admin 983jqAM [AUDIT] admin tool executing a dry-run with the following arguments: "bin/admin -config labca/config/admin.json revoke-cert -serial 7fb2d308a535cc7d5453b2c40fcd2456d364 -reason superseded" gui-1 | 2024-07-09T16:29:07.703089+00:00Z admin[1022]: 6 admin 6MX16g0 Found 1 certificates to revoke gui-1 | 2024-07-09T16:29:07.703847+00:00Z admin[1022]: 6 admin oN-h9wY dry-run: "serial:"7fb2d308a535cc7d5453b2c40fcd2456d364" code:4 adminName:"root"" gui-1 | 2024-07-09T16:29:07.703879+00:00Z admin[1022]: 6 admin 9_mC6gM [AUDIT] admin tool has successfully completed executing a dry-run with the following arguments: "bin/admin -config labca/config/admin.json revoke-cert -serial 7fb2d308a535cc7d5453b2c40fcd2456d364 -reason superseded" gui-1 | 2024-07-09T16:29:07.703894+00:00Z admin[1022]: 6 admin 7tT7rAY Dry run complete. Pass -dry-run=false to mutate the database.'

Adding "-dry-run=false" to the command does the trick, but not sure if this breaks something else.

[hakwerk]

Thanks for the info! I will have a better look when I find some time

... but not sure if this breaks something else.

I expect it will be totally fine, but I need to have a better look at it

[OliverSCE]

You are probably right, so far it seems to be totally fine, except that the revoke reason is hardwired in the command file.

[hakwerk]

This should now be solved in the v24.08 release