OCSP on pkidestroy should ask the CA to remove its publisher.

[pki-bot]

This issue was migrated from Pagure Issue #1362. Originally filed by jmagne (@jmagne) on 2015-05-01 18:55:37:

• Assigned to nobody

---

This is based on observations when working on another ticket.

1. Create a CA

2. Create a master OCSP, this results in the installer procedure registering this CRL as a publisher within the CA.

3. Perform pkidestroy on the the OCSP.

4. Based upon my observations, the now deceased OCSP is still listed in the config as a publisher and the publishing rule is still active.

Additional info:

I actually tried the following scenario by creating and deleting an outboard OCSP. The following occurred:

1. The config was not changed in the CA's CS.cfg.
2. I went into the agent interface to schedule a CRL publish.
3. The publish was attempted even though the OCSP is gone.
4. The logs here show the following for this event:

01/May/2015:09:50:38][CRLIssuingPoint-MasterCRL]: Publish CRL
[01/May/2015:09:50:38][CRLIssuingPoint-MasterCRL]: OCSPPublisher: Host='localhost.localdomain' Port='8443' URL='/ocsp/agent/ocsp/addCRL'
[01/May/2015:09:50:38][CRLIssuingPoint-MasterCRL]: OCSPPublisher: start CRL sending startTime=1430499038798
[01/May/2015:09:50:38][CRLIssuingPoint-MasterCRL]: OCSPPublisher: done CRL sending endTime=1430499038798 diff=0
[01/May/2015:09:51:38][CRLIssuingPoint-MasterCRL]: CRL published.

At least the debug log is not reporting the failure, some other one may I need to check.

At the very least though, the CA should not have to even attempt to publish to defunct publishing targets for the CRL, at the very minimum , if we want to preserve the entry in the name of non destructive behavior, we disable the publisher and re-enable it later if it gets re-added in the future.

[pki-bot]

Comment from mharmsen (@mharmsen) at 2015-05-04 20:18:14

Per CS/DS meeting of 05/04/2015: 10.3

[pki-bot]

Comment from jmagne (@jmagne) at 2017-02-27 13:58:22

Metadata Update from @jmagne:

• Issue set to the milestone: UNTRIAGED