Skip to content

Commit 53f82ec

Browse files
aarongableaarongable
authored
Ceremony: remove support for AIA OCSP URIs (#8397)
Remove the ability to configure an ocsp-url from the ceremony tool's root, intermediate, cross-sign, and csr ceremony types. We have not used this field in our last several ceremonies, and do not plan to go back to including AIA OCSP URIs in our CA certificates at any time in the foreseeable future.
1 parent ea200c2 commit 53f82ec

File tree

4 files changed

+0
-35
lines changed

4 files changed

+0
-35
lines changed

‎cmd/ceremony/README.md‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -127,7 +127,6 @@ certificate-profile:
127127
country: US
128128
not-before: 2020-01-01 12:00:00
129129
not-after: 2040-01-01 12:00:00
130-
ocsp-url: http://good-guys.com/ocsp
131130
crl-url: http://good-guys.com/crl
132131
issuer-url: http://good-guys.com/root
133132
policies:
@@ -192,7 +191,6 @@ certificate-profile:
192191
country: US
193192
not-before: 2020-01-01 12:00:00
194193
not-after: 2040-01-01 12:00:00
195-
ocsp-url: http://good-guys.com/ocsp
196194
crl-url: http://good-guys.com/crl
197195
issuer-url: http://good-guys.com/root
198196
policies:
@@ -363,7 +361,6 @@ The certificate profile defines a restricted set of fields that are used to gene
363361
| `country` | Specifies the subject country |
364362
| `not-before` | Specifies the certificate notBefore date, in the format `2006-01-02 15:04:05`. The time will be interpreted as UTC. |
365363
| `not-after` | Specifies the certificate notAfter date, in the format `2006-01-02 15:04:05`. The time will be interpreted as UTC. |
366-
| `ocsp-url` | Specifies the AIA OCSP responder URL |
367364
| `crl-url` | Specifies the cRLDistributionPoints URL |
368365
| `issuer-url` | Specifies the AIA caIssuer URL |
369366
| `policies` | Specifies contents of a certificatePolicies extension. Should contain a list of policies with the field `oid`, indicating the policy OID. |

‎cmd/ceremony/cert.go‎

Lines changed: 0 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -41,9 +41,6 @@ type certProfile struct {
4141
// always be UTC.
4242
NotAfter string `yaml:"not-after"`
4343

44-
// OCSPURL should contain the URL at which a OCSP responder that
45-
// can respond to OCSP requests for this certificate operates
46-
OCSPURL string `yaml:"ocsp-url"`
4744
// CRLURL should contain the URL at which CRLs for this certificate
4845
// can be found
4946
CRLURL string `yaml:"crl-url"`
@@ -100,9 +97,6 @@ func (profile *certProfile) verifyProfile(ct certType) error {
10097
if profile.SignatureAlgorithm != "" {
10198
return errors.New("signature-algorithm cannot be set for a CSR")
10299
}
103-
if profile.OCSPURL != "" {
104-
return errors.New("ocsp-url cannot be set for a CSR")
105-
}
106100
if profile.CRLURL != "" {
107101
return errors.New("crl-url cannot be set for a CSR")
108102
}
@@ -205,10 +199,6 @@ func makeTemplate(randReader io.Reader, profile *certProfile, pubKey []byte, tbc
205199
return nil, fmt.Errorf("toBeCrossSigned cert field was nil, but was required to gather EKUs for the lint cert")
206200
}
207201

208-
var ocspServer []string
209-
if profile.OCSPURL != "" {
210-
ocspServer = []string{profile.OCSPURL}
211-
}
212202
var crlDistributionPoints []string
213203
if profile.CRLURL != "" {
214204
crlDistributionPoints = []string{profile.CRLURL}
@@ -246,7 +236,6 @@ func makeTemplate(randReader io.Reader, profile *certProfile, pubKey []byte, tbc
246236
BasicConstraintsValid: true,
247237
IsCA: true,
248238
Subject: profile.Subject(),
249-
OCSPServer: ocspServer,
250239
CRLDistributionPoints: crlDistributionPoints,
251240
IssuingCertificateURL: issuingCertificateURL,
252241
KeyUsage: ku,

‎cmd/ceremony/cert_test.go‎

Lines changed: 0 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -109,7 +109,6 @@ func TestMakeTemplateRoot(t *testing.T) {
109109
profile.CommonName = "common name"
110110
profile.Organization = "organization"
111111
profile.Country = "country"
112-
profile.OCSPURL = "ocsp"
113112
profile.CRLURL = "crl"
114113
profile.IssuerURL = "issuer"
115114
cert, err := makeTemplate(randReader, profile, pubKey, nil, rootCert)
@@ -119,8 +118,6 @@ func TestMakeTemplateRoot(t *testing.T) {
119118
test.AssertEquals(t, cert.Subject.Organization[0], profile.Organization)
120119
test.AssertEquals(t, len(cert.Subject.Country), 1)
121120
test.AssertEquals(t, cert.Subject.Country[0], profile.Country)
122-
test.AssertEquals(t, len(cert.OCSPServer), 1)
123-
test.AssertEquals(t, cert.OCSPServer[0], profile.OCSPURL)
124121
test.AssertEquals(t, len(cert.CRLDistributionPoints), 1)
125122
test.AssertEquals(t, cert.CRLDistributionPoints[0], profile.CRLURL)
126123
test.AssertEquals(t, len(cert.IssuingCertificateURL), 1)
@@ -147,7 +144,6 @@ func TestMakeTemplateRestrictedCrossCertificate(t *testing.T) {
147144
Organization: "organization",
148145
Country: "country",
149146
KeyUsages: []string{"Digital Signature", "CRL Sign"},
150-
OCSPURL: "ocsp",
151147
CRLURL: "crl",
152148
IssuerURL: "issuer",
153149
NotAfter: "2020-10-10 11:31:00",
@@ -237,7 +233,6 @@ func TestVerifyProfile(t *testing.T) {
237233
CommonName: "d",
238234
Organization: "e",
239235
Country: "f",
240-
OCSPURL: "g",
241236
},
242237
certType: []certType{intermediateCert, crossCert},
243238
expectedErr: "crl-url is required for subordinate CAs",
@@ -250,7 +245,6 @@ func TestVerifyProfile(t *testing.T) {
250245
CommonName: "d",
251246
Organization: "e",
252247
Country: "f",
253-
OCSPURL: "g",
254248
CRLURL: "h",
255249
},
256250
certType: []certType{intermediateCert, crossCert},
@@ -264,7 +258,6 @@ func TestVerifyProfile(t *testing.T) {
264258
CommonName: "d",
265259
Organization: "e",
266260
Country: "f",
267-
OCSPURL: "g",
268261
CRLURL: "h",
269262
IssuerURL: "i",
270263
},
@@ -279,7 +272,6 @@ func TestVerifyProfile(t *testing.T) {
279272
CommonName: "d",
280273
Organization: "e",
281274
Country: "f",
282-
OCSPURL: "g",
283275
CRLURL: "h",
284276
IssuerURL: "i",
285277
Policies: []policyInfoConfig{{OID: "1.2.3"}, {OID: "4.5.6"}},
@@ -319,13 +311,6 @@ func TestVerifyProfile(t *testing.T) {
319311
certType: []certType{requestCert},
320312
expectedErr: "signature-algorithm cannot be set for a CSR",
321313
},
322-
{
323-
profile: certProfile{
324-
OCSPURL: "a",
325-
},
326-
certType: []certType{requestCert},
327-
expectedErr: "ocsp-url cannot be set for a CSR",
328-
},
329314
{
330315
profile: certProfile{
331316
CRLURL: "a",

‎cmd/ceremony/main_test.go‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -403,7 +403,6 @@ func TestIntermediateConfigValidate(t *testing.T) {
403403
CommonName: "d",
404404
Organization: "e",
405405
Country: "f",
406-
OCSPURL: "g",
407406
CRLURL: "h",
408407
IssuerURL: "i",
409408
Policies: []policyInfoConfig{{OID: "2.23.140.1.2.1"}, {OID: "6.6.6"}},
@@ -438,7 +437,6 @@ func TestIntermediateConfigValidate(t *testing.T) {
438437
CommonName: "d",
439438
Organization: "e",
440439
Country: "f",
441-
OCSPURL: "g",
442440
CRLURL: "h",
443441
IssuerURL: "i",
444442
Policies: []policyInfoConfig{},
@@ -473,7 +471,6 @@ func TestIntermediateConfigValidate(t *testing.T) {
473471
CommonName: "d",
474472
Organization: "e",
475473
Country: "f",
476-
OCSPURL: "g",
477474
CRLURL: "h",
478475
IssuerURL: "i",
479476
Policies: []policyInfoConfig{{OID: "2.23.140.1.2.1"}},
@@ -631,7 +628,6 @@ func TestCrossCertConfigValidate(t *testing.T) {
631628
CommonName: "d",
632629
Organization: "e",
633630
Country: "f",
634-
OCSPURL: "g",
635631
CRLURL: "h",
636632
IssuerURL: "i",
637633
Policies: []policyInfoConfig{{OID: "2.23.140.1.2.1"}, {OID: "6.6.6"}},
@@ -668,7 +664,6 @@ func TestCrossCertConfigValidate(t *testing.T) {
668664
CommonName: "d",
669665
Organization: "e",
670666
Country: "f",
671-
OCSPURL: "g",
672667
CRLURL: "h",
673668
IssuerURL: "i",
674669
Policies: []policyInfoConfig{},
@@ -705,7 +700,6 @@ func TestCrossCertConfigValidate(t *testing.T) {
705700
CommonName: "d",
706701
Organization: "e",
707702
Country: "f",
708-
OCSPURL: "g",
709703
CRLURL: "h",
710704
IssuerURL: "i",
711705
Policies: []policyInfoConfig{{OID: "2.23.140.1.2.1"}},

0 commit comments

Comments
 (0)