Two PKI improvements: #5134
Merged
Two PKI improvements: #5134
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
* Disallow adding CA's serial to revocation list * Allow disabling revocation list generation. This returns an empty (but signed) list, but does not affect tracking of revocations so turning it back on will populate the list properly.
Xopherus
reviewed
Aug 20, 2018
|
|
||
| ~> Note: Disabling the CRL does not affect whether revoked certificates are | ||
| stored internally. Certificates that have been revoked when a role's | ||
| certificate storage is enabled will continue to be marked and stored as |
There was a problem hiding this comment.
The certificate store shouldn't be a bottleneck because each cert is stored in a different k/v pair in the Consul storage backend - whereas the CRL is stored in a single k/v pair? Is that right @jefferai ?
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
signed) list, but does not affect tracking of revocations so turning it
back on will populate the list properly.