Revocation of x509 cert by serial does not check the serial number

[ftoppi]

Revocation of x509 cert by serial does not check the serial number

When a certificate is revoked by serial number, the given serial number is added as-is to the database, without checking if it matches an existing certificate. If it does match an existing certificate, it is not converted to decimal if to maintain consistency.

Your environment

• OS - Docker image
• Version - 0.17.4

Steps to reproduce

~ $ step ca revoke foobar
✔ Provisioner: admin (JWK) [kid: x]
✔ Please enter the password to decrypt the provisioner key:
✔ CA: https://ca.local:8500
Certificate with Serial Number foobar has been revoked.

~ $ echo "select nkey from x509_certs" | mysql -u ca -p -h 172.25.0.2 ca
nkey
177860565322912551485094850643435652321
284535634410917533937726757688444911587

~ $ echo "select nkey from revoked_x509_certs" | mysql -u ca -p -h 172.25.0.2 ca
nkey
foobar

Expected behaviour

Revoke command should fail stating the serial number does not match an issued certificate.

Actual behaviour

Revoke command succeeds and arbitrary serial number is added to the revoked_x509_certs table.

Additional context

If the serial number is passed as hexadecimal string and matches an issued certificate, it should be converted to decimal to maintain consistency with revocation using cert+key. See below.

Serial number of my.crt in decimal and hexadecimal:

~ $ step certificate inspect my.crt | grep ^Serial
Serial Number: 284535634410917533937726757688444911587 (0xd60f91e210831b0363b9d95256aeffe3)

Revoking with cert+key adds serial in decimal to revoked_x509_certs table:

~ $ step ca revoke --cert my.crt --key my.key
✔ CA: https://ca.local:8500
Certificate with Serial Number 284535634410917533937726757688444911587 has been revoked.

~ $ echo "select nkey from x509_certs" | mysql -u ca -p -h 172.25.0.2 ca
nkey
177860565322912551485094850643435652321
284535634410917533937726757688444911587

~ $  echo "select nkey from revoked_x509_certs" | mysql -u ca -p -h 172.25.0.2 ca
nkey
284535634410917533937726757688444911587

Revoking with serial (passed as hexa) adds serial in hexa (as-is) to revoked_x509_certs table:

~ $ step ca revoke d60f91e210831b0363b9d95256aeffe3
✔ Provisioner: admin (JWK) [kid: x]
✔ Please enter the password to decrypt the provisioner key:
✔ CA: https://ca.local:8500
Certificate with Serial Number d60f91e210831b0363b9d95256aeffe3 has been revoked.

~ $ echo "select nkey from x509_certs" | mysql -u ca -p -h 172.25.0.2 ca
nkey
177860565322912551485094850643435652321
284535634410917533937726757688444911587

~ $ echo "select nkey from revoked_x509_certs" | mysql -u ca -p -h 172.25.0.2 ca
nkey
d60f91e210831b0363b9d95256aeffe3

[dopey]

We're treating the current behavior as a "feature". You should be able to revoke certificates that are not in the DB in case the DB was lost or deleted but the PKI still exists.

We do plan to work on revocation soon (in the context of Renewal After Expiry) and at that point we may add features to the existing revocation API to help with misuse of step ca revoke.