gnoi cert.proto: Need clarity on RevokeCertificates rpc

[Devendra-Vamsi]

Let's say the target device uses certificate named "ee-cert1" to establish connection with the gNOI client. After establishment of this connection, if the gNOI client calls RevokeCertificates() rpc with certificate_id "ee-cert1" then what is the expected behavior from Target device? Should it revoke the certificate "ee-cert1" and return success or should it fail this revocation with error message like "certificate in use"?

[samribeiro]

This is not specified in the service definition. The proto needs to be augmented to specify it. There is no currently commonly agreed preference. At the moment you are free to implement your preferred behavior. However here are a few notes:

• An endpoint can potentially have more than one certificate ID assigned, therefore some revocations can likely be executed without impacting the endpoint, just by removing the assigned ID from the list;
• The current CertificateInfo->endpoints->type may not have all the endpoint types supported, therefore it may not be possible for a system to list what certificate ids are actually being used by any endpoint solely by using this service, therefore the safer approach for revoking a used certificate would be to fail with an error message;
• From a security perspective, if a certificate is revoked, immediately all endpoints should cease to use it, regardless of whether it is currently in use or not.