Clean up active revocation via API

- amend outdated comments to reflect active revocation being supported
- amend tests to no longer assert an error message upon active
  revocation and to instead validate the success on either revocation
  variant

In theory the "Passive" boolean seems removable as it does not add any
functionality besides being logged, but it was found some instances of
it are still needed to block active revocation for SSH certificates.

Signed-off-by: Georg Pfuetzenreuter <[email protected]>

Author: tacerus

api/revoke.go

@@ -48,9 +48,7 @@ func (r *RevokeRequest) Validate() (err error) {
 
 // Revoke supports handful of different methods that revoke a Certificate.
 //
-// NOTE: currently only Passive revocation is supported.
-//
-// TODO: Add CRL and OCSP support.
+// TODO: Add OCSP support.
 func Revoke(w http.ResponseWriter, r *http.Request) {
 	var body RevokeRequest
 	if err := read.JSON(r.Body, &body); err != nil {

api/revoke_test.go

@@ -43,19 +43,18 @@ func TestRevokeRequestValidate(t *testing.T) {
 			},
 			err: &errs.Error{Err: errors.New("reasonCode out of bounds"), Status: http.StatusBadRequest},
 		},
-		"error/non-passive not implemented": {
+		"ok/passive": {
 			rr: &RevokeRequest{
 				Serial:     "10",
-				ReasonCode: 8,
-				Passive:    false,
+				ReasonCode: 9,
+				Passive:    true,
 			},
-			err: &errs.Error{Err: errors.New("non-passive revocation not implemented"), Status: http.StatusNotImplemented},
 		},
-		"ok": {
+		"ok/active": {
 			rr: &RevokeRequest{
 				Serial:     "10",
 				ReasonCode: 9,
-				Passive:    true,
+				Passive:    false,
 			},
 		},
 	}

authority/tls.go

@@ -568,10 +568,7 @@ type RevokeOptions struct {
 
 // Revoke revokes a certificate.
 //
-// NOTE: Only supports passive revocation - prevent existing certificates from
-// being renewed.
-//
-// TODO: Add OCSP and CRL support.
+// TODO: Add OCSP support.
 func (a *Authority) Revoke(ctx context.Context, revokeOpts *RevokeOptions) error {
 	opts := []interface{}{
 		errs.WithKeyVal("serialNumber", revokeOpts.Serial),