[HDDS-7333] Implement support for certificate revocation

• Type: Improvement
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Component/s: Security
• Labels: certificate_revocation pki
• Assignee: István Fajth
• Reporter: István Fajth
• Created: 14/Oct/22 21:24
• Updated: 21/May/24 09:57

Description

Our current code contains parts of the implementation that was driven by the design doc in HDDS-2731. In the documentation in HDDS-7331 it is discussed why an other approach is more beneficial for us.
The goals here are based on the new proposed approach:

• create CRL distribution endpoint in SCMs
• add cRLDistributionPoints property to our internal certificates
• internalize the revocation logic inside SCMs
• add CLI for certificate revocation
• integrate certificate revocation check based on the CRL distribution points where needed
• handle renewal, revoke and remove old certificate

Issue Links

• blocks: HDDS-7331 Ozone PKI improvements
• is duplicated by: HDDS-105 SCM CA: Handle CRL
• relates to: HDDS-10889 Remove certificate revocation related code.

Sub-Tasks

• Create a CRL endpoint in SCM: Open
• Include SCM{s)'s cRLDisributionPoint to the certificates used internally: Open
• Re-organize existing certificate revocation logic in the current codebase: Open
• Add CLI to initiate certificate revocation: Open
• Owned certificate's revocation check for services: Open
• Revoke old certificate once a service renews its certificate: Open
• Root CA certificate revocation: Open
• Subordinate CA certificate revocation: Open