Repository: dogtagpki/pki
Pull request #5021: Replace SSLSocket with JSSSocket in CLI
Author: login: fmarco76
Created: 2025-03-28T10:16:48Z | Merged: 2025-04-07T08:01:02Z

The JSSSocket allows both sync and async communication used by modern framework.

The main difference when used with current clients is related to certificate verification. JSSSocket enables OCSP and CRL-DP verification. This could be a problem in some scenario where the server cannot be accessed for the verification. Although it is possible to ignore the error using the `pki` option `--ignore-cert-status <status>` a new option allows to skip the verification: `--skip-revocation-check`.

The client enable the revocation check by default but there are problem when the CA act as a client to perform some operation. For this reason a new option is added, `ca.clientRevocationCheck`, which default to false. This can be configured with pkispawn using the option `pki_client_verify_cert` (default `False`).

The client operations performed during `pkispawn`/`pkidestroy` have the revocation check disabled.

An option to control the revocation check during installation and deletion, and some workflow to verify they are working, will be done in separate PR.



Diff:
diff --git a/.github/workflows/ca-container-existing-config-test.yml b/.github/workflows/ca-container-existing-config-test.yml
index d23c0adcb1e..0a5c8dfc6e4 100644
--- a/.github/workflows/ca-container-existing-config-test.yml
+++ b/.github/workflows/ca-container-existing-config-test.yml
@@ -277,9 +277,11 @@ jobs:
 
       - name: Check CA admin user again
         run: |
+          #TODO: OCSPServlet fails since AuthorityMonitor is disabled in container
           docker exec client pki \
               -U https://ca.example.com:8443 \
               -n caadmin \
+              --ignore-cert-status OCSP_SERVER_ERROR \
               ca-user-show \
               caadmin
 
@@ -287,6 +289,7 @@ jobs:
         run: |
           docker exec client pki \
               -U https://ca.example.com:8443 \
+              --ignore-cert-status OCSP_SERVER_ERROR \
               client-cert-request \
               uid=testuser | tee output
 
@@ -296,6 +299,7 @@ jobs:
           docker exec client pki \
               -U https://ca.example.com:8443 \
               -n caadmin \
+              --ignore-cert-status OCSP_SERVER_ERROR \
               ca-cert-request-approve \
               $REQUEST_ID \
               --force
diff --git a/.github/workflows/ca-container-migration-test.yml b/.github/workflows/ca-container-migration-test.yml
index 5f12cd2a345..d0f6706056d 100644
--- a/.github/workflows/ca-container-migration-test.yml
+++ b/.github/workflows/ca-container-migration-test.yml
@@ -289,9 +289,11 @@ jobs:
 
       - name: Check CA admin user
         run: |
+          #TODO: after migration the OCSPServlet is failing and has to be fixed
           docker exec client pki \
               -U https://pki.example.com:8443 \
               -n caadmin \
+              --ignore-cert-status OCSP_SERVER_ERROR \
               ca-user-show \
               caadmin
 
@@ -299,6 +301,7 @@ jobs:
         run: |
           docker exec client pki \
               -U https://pki.example.com:8443 \
+              --ignore-cert-status OCSP_SERVER_ERROR \
               client-cert-request \
               uid=testuser | tee output
 
@@ -308,6 +311,7 @@ jobs:
           docker exec client pki \
               -U https://pki.example.com:8443 \
               -n caadmin \
+              --ignore-cert-status OCSP_SERVER_ERROR \
               ca-cert-request-approve \
               $REQUEST_ID \
               --force
diff --git a/.github/workflows/ca-ds-connection-test.yml b/.github/workflows/ca-ds-connection-test.yml
index 6dc9414d8c5..79a30e31188 100644
--- a/.github/workflows/ca-ds-connection-test.yml
+++ b/.github/workflows/ca-ds-connection-test.yml
@@ -109,6 +109,7 @@ jobs:
           # enrollment should fail
           docker exec pki pki \
               -n caadmin \
+              --ignore-cert-status OCSP_SERVER_ERROR \
               ca-cert-issue \
               --profile caServerCert \
               --csr-file sslserver.csr \
@@ -145,6 +146,7 @@ jobs:
           # enrollment should fail
           docker exec pki pki \
               -n caadmin \
+              --ignore-cert-status OCSP_SERVER_ERROR \
               ca-cert-issue \
               --profile caServerCert \
               --csr-file sslserver.csr \
@@ -163,8 +165,10 @@ jobs:
           sleep 60
 
           # enrollment should work
+          # OCSP is not working because the authorityMonitor is disabled
           docker exec pki pki \
               -n caadmin \
+              --ignore-cert-status OCSP_SERVER_ERROR \
               ca-cert-issue \
               --profile caServerCert \
               --csr-file sslserver.csr \
diff --git a/.github/workflows/ca-renewal-system-certs-hsm-test.yml b/.github/workflows/ca-renewal-system-certs-hsm-test.yml
index 3acb74dacdd..8513cba839c 100644
--- a/.github/workflows/ca-renewal-system-certs-hsm-test.yml
+++ b/.github/workflows/ca-renewal-system-certs-hsm-test.yml
@@ -268,9 +268,11 @@ jobs:
           CERT_ID=$(sed -n "s/^\s*Serial Number:\s*\(\S*\)$/\1/p" output)
 
           # renew cert
+          # NOTE: since OCSP cert is expired certificate validation fails and marked as revoked
           docker exec pki pki \
               -u caadmin \
               -w Secret.123 \
+              --ignore-cert-status REVOKED_CERTIFICATE \
               ca-cert-issue \
               --profile caManualRenewal \
               --serial $CERT_ID \
@@ -293,9 +295,11 @@ jobs:
           CERT_ID=$(sed -n "s/^\s*Serial Number:\s*\(\S*\)$/\1/p" output)
 
           # renew cert
+          # NOTE: since OCSP cert is expired certificate validation fails and marked as revoked
           docker exec pki pki \
               -u caadmin \
               -w Secret.123 \
+              --ignore-cert-status REVOKED_CERTIFICATE \
               ca-cert-issue \
               --profile caManualRenewal \
               --serial $CERT_ID \
@@ -335,9 +339,11 @@ jobs:
           CERT_ID=$(sed -n "s/^\s*Serial Number:\s*\(\S*\)$/\1/p" output)
 
           # renew cert
+          # NOTE: since OCSP cert is expired certificate validation fails and marked as revoked
           docker exec pki pki \
               -u caadmin \
               -w Secret.123 \
+              --ignore-cert-status REVOKED_CERTIFICATE \
               ca-cert-issue \
               --profile caManualRenewal \
               --serial $CERT_ID \
@@ -360,9 +366,11 @@ jobs:
           CERT_ID=$(sed -n "s/^\s*Serial Number:\s*\(\S*\)$/\1/p" output)
 
           # renew cert
+          # NOTE: since OCSP cert is expired certificate validation fails and marked as revoked
           docker exec pki pki \
               -u caadmin \
               -w Secret.123 \
+              --ignore-cert-status REVOKED_CERTIFICATE \
               ca-cert-issue \
               --profile caManualRenewal \
               --serial $CERT_ID \
@@ -385,9 +393,11 @@ jobs:
           CERT_ID=$(sed -n "s/^\s*Serial Number:\s*\(\S*\)$/\1/p" output)
 
           # renew cert
+          # NOTE: since OCSP cert is expired certificate validation fails and marked as revoked
           docker exec pki pki \
               -u caadmin \
               -w Secret.123 \
+              --ignore-cert-status REVOKED_CERTIFICATE \
               ca-cert-issue \
               --profile caManualRenewal \
               --serial $CERT_ID \
diff --git a/.github/workflows/ca-renewal-system-certs-test.yml b/.github/workflows/ca-renewal-system-certs-test.yml
index a6cc2f91f75..eb2542759c9 100644
--- a/.github/workflows/ca-renewal-system-certs-test.yml
+++ b/.github/workflows/ca-renewal-system-certs-test.yml
@@ -231,9 +231,11 @@ jobs:
           CERT_ID=$(sed -n "s/^\s*Serial Number:\s*\(\S*\)$/\1/p" output)
 
           # renew cert
+          # NOTE: since OCSP cert is expired certificate validation fails and marked as revoked
           docker exec pki pki \
               -u caadmin \
               -w Secret.123 \
+              --ignore-cert-status REVOKED_CERTIFICATE \
               ca-cert-issue \
               --profile caManualRenewal \
               --serial $CERT_ID \
@@ -256,9 +258,11 @@ jobs:
           CERT_ID=$(sed -n "s/^\s*Serial Number:\s*\(\S*\)$/\1/p" output)
 
           # renew cert
+          # NOTE: since OCSP cert is expired certificate validation fails and marked as revoked
           docker exec pki pki \
               -u caadmin \
               -w Secret.123 \
+              --ignore-cert-status REVOKED_CERTIFICATE \
               ca-cert-issue \
               --profile caManualRenewal \
               --serial $CERT_ID \
@@ -298,9 +302,11 @@ jobs:
           CERT_ID=$(sed -n "s/^\s*Serial Number:\s*\(\S*\)$/\1/p" output)
 
           # renew cert
+          # NOTE: since OCSP cert is expired certificate validation fails and marked as revoked
           docker exec pki pki \
               -u caadmin \
               -w Secret.123 \
+              --ignore-cert-status REVOKED_CERTIFICATE \
               ca-cert-issue \
               --profile caManualRenewal \
               --serial $CERT_ID \
@@ -323,9 +329,11 @@ jobs:
           CERT_ID=$(sed -n "s/^\s*Serial Number:\s*\(\S*\)$/\1/p" output)
 
           # renew cert
+          # NOTE: since OCSP cert is expired certificate validation fails and marked as revoked
           docker exec pki pki \
               -u caadmin \
               -w Secret.123 \
+              --ignore-cert-status REVOKED_CERTIFICATE \
               ca-cert-issue \
               --profile caManualRenewal \
               --serial $CERT_ID \
@@ -348,9 +356,11 @@ jobs:
           CERT_ID=$(sed -n "s/^\s*Serial Number:\s*\(\S*\)$/\1/p" output)
 
           # renew cert
+          # NOTE: since OCSP cert is expired certificate validation fails and marked as revoked
           docker exec pki pki \
               -u caadmin \
               -w Secret.123 \
+              --ignore-cert-status REVOKED_CERTIFICATE \
               ca-cert-issue \
               --profile caManualRenewal \
               --serial $CERT_ID \
diff --git a/.github/workflows/ipa-basic-test.yml b/.github/workflows/ipa-basic-test.yml
index 18a3bf2164b..fc22b63fdf7 100644
--- a/.github/workflows/ipa-basic-test.yml
+++ b/.github/workflows/ipa-basic-test.yml
@@ -34,6 +34,7 @@ jobs:
               --hostname=ipa.example.com \
               --network=example \
               --network-alias=ipa.example.com \
+              --network-alias=ipa-ca.example.com \
               ipa
 
       - name: Install IPA server
diff --git a/.github/workflows/ipa-clone-test.yml b/.github/workflows/ipa-clone-test.yml
index 11b4824247e..6abc2a75e0a 100644
--- a/.github/workflows/ipa-clone-test.yml
+++ b/.github/workflows/ipa-clone-test.yml
@@ -34,6 +34,7 @@ jobs:
               --hostname=primary.example.com \
               --network=example \
               --network-alias=primary.example.com \
+              --network-alias=ipa-ca.example.com \
               primary
 
       - name: Install IPA server in primary container
@@ -631,7 +632,8 @@ jobs:
           docker exec secondary pki pkcs12-import \
               --pkcs12 ${SHARED}/ca-agent.p12 \
               --pkcs12-password Secret.123
-          docker exec secondary pki -n ipa-ca-agent ca-user-show admin
+          docker exec secondary pki -n ipa-ca-agent \
+              ca-user-show admin
 
       - name: Check subca replication from primary
         run: |
diff --git a/.github/workflows/ipa-kra-test.yml b/.github/workflows/ipa-kra-test.yml
index 68e4216489d..50cb05d8cd9 100644
--- a/.github/workflows/ipa-kra-test.yml
+++ b/.github/workflows/ipa-kra-test.yml
@@ -34,6 +34,7 @@ jobs:
               --hostname=ipa.example.com \
               --network=example \
               --network-alias=ipa.example.com \
+              --network-alias=ipa-ca.example.com \
               ipa
 
       - name: Install IPA server
diff --git a/.github/workflows/ipa-reinstall-test.yml b/.github/workflows/ipa-reinstall-test.yml
index 101efff69c2..0c5c43b88a6 100644
--- a/.github/workflows/ipa-reinstall-test.yml
+++ b/.github/workflows/ipa-reinstall-test.yml
@@ -34,6 +34,7 @@ jobs:
               --hostname=ipa.example.com \
               --network=example \
               --network-alias=ipa.example.com \
+              --network-alias=ipa-ca.example.com \
               ipa
 
       - name: Install IPA server
diff --git a/.github/workflows/ipa-renewal-test.yml b/.github/workflows/ipa-renewal-test.yml
index 49694006ddd..0ea81066a48 100644
--- a/.github/workflows/ipa-renewal-test.yml
+++ b/.github/workflows/ipa-renewal-test.yml
@@ -34,6 +34,7 @@ jobs:
               --hostname=ipa.example.com \
               --network=example \
               --network-alias=ipa.example.com \
+              --network-alias=ipa-ca.example.com \
               ipa
 
       - name: Configure short-lived SSL server cert profile
@@ -187,7 +188,7 @@ jobs:
           docker exec ipa pki nss-cert-show ipa-ca-agent
 
           # CA admin should be able to access PKI users
-          docker exec ipa pki -n ipa-ca-agent ca-user-find
+          docker exec ipa pki -n ipa-ca-agent --ignore-cert-status EXPIRED_CERTIFICATE ca-user-find
 
       - name: Check RA agent cert
         run: |
@@ -211,7 +212,7 @@ jobs:
           docker exec ipa pki nss-cert-show ipa-ra-agent
 
           # RA agent should be able to access cert requests
-          docker exec ipa pki -n ipa-ra-agent ca-cert-request-find
+          docker exec ipa pki -n ipa-ra-agent --ignore-cert-status EXPIRED_CERTIFICATE ca-cert-request-find
 
       - name: Run PKI healthcheck
         run: |
diff --git a/.github/workflows/server-https-nss-test.yml b/.github/workflows/server-https-nss-test.yml
index 9bd0b3780fa..73d4688392f 100644
--- a/.github/workflows/server-https-nss-test.yml
+++ b/.github/workflows/server-https-nss-test.yml
@@ -180,7 +180,6 @@ jobs:
         run: |
           # run PKI CLI but don't trust the cert
           echo n | docker exec -i client pki \
-              -D org.dogtagpki.client.socketFactory=org.dogtagpki.client.NonBlockingSocketFactory \
               -U https://pki.example.com:8443 \
               info \
               > >(tee stdout) 2> >(tee stderr >&2) || true
@@ -210,7 +209,6 @@ jobs:
         run: |
           # run PKI CLI with wrong hostname
           echo n | docker exec -i client pki \
-              -D org.dogtagpki.client.socketFactory=org.dogtagpki.client.NonBlockingSocketFactory \
               -U https://server.example.com:8443 \
               info \
               > >(tee stdout) 2> >(tee stderr >&2) || true
@@ -241,7 +239,6 @@ jobs:
         run: |
           # run PKI CLI and trust the cert
           echo y | docker exec -i client pki \
-              -D org.dogtagpki.client.socketFactory=org.dogtagpki.client.NonBlockingSocketFactory \
               -U https://pki.example.com:8443 \
               info \
               > >(tee stdout) 2> >(tee stderr >&2) || true
@@ -291,7 +288,6 @@ jobs:
         run: |
           # run PKI CLI with wrong hostname
           docker exec client pki \
-              -D org.dogtagpki.client.socketFactory=org.dogtagpki.client.NonBlockingSocketFactory \
               -U https://server.example.com:8443 \
               info \
               > >(tee stdout) 2> >(tee stderr >&2) || true
@@ -316,7 +312,6 @@ jobs:
         run: |
           # run PKI CLI with correct hostname
           docker exec client pki \
-              -D org.dogtagpki.client.socketFactory=org.dogtagpki.client.NonBlockingSocketFactory \
               -U https://pki.example.com:8443 \
               info \
               > >(tee stdout) 2> >(tee stderr >&2) || true
@@ -338,7 +333,6 @@ jobs:
           sleep 120
 
           docker exec client pki \
-              -D org.dogtagpki.client.socketFactory=org.dogtagpki.client.NonBlockingSocketFactory \
               -U https://pki.example.com:8443 \
               info \
               > >(tee stdout) 2> >(tee stderr >&2) || true
diff --git a/.github/workflows/server-https-pkcs12-test.yml b/.github/workflows/server-https-pkcs12-test.yml
index ac8dab1f15b..dd82dce2f8a 100644
--- a/.github/workflows/server-https-pkcs12-test.yml
+++ b/.github/workflows/server-https-pkcs12-test.yml
@@ -215,8 +215,8 @@ jobs:
           # check stderr
           cat > expected << EOF
           WARNING: UNKNOWN_ISSUER encountered on 'CN=pki.example.com' indicates an unknown CA cert 'CN=CA Signing Certificate'
-          Trust this certificate (y/N)? SEVERE: FATAL: SSL alert sent: BAD_CERTIFICATE
-          IOException: Unable to write to socket: Failed to write to socket: (-5987) Invalid function argument.
+          Trust this certificate (y/N)? SEVERE: FATAL: SSL alert sent: UNKNOWN_CA
+          IOException: Unable to write to socket: Unable to validate CN=pki.example.com: Unknown issuer: CN=CA Signing Certificate
           EOF
 
           diff expected stderr
@@ -243,10 +243,10 @@ jobs:
 
           # check stderr
           cat > expected << EOF
-          WARNING: UNKNOWN_ISSUER encountered on 'CN=pki.example.com' indicates an unknown CA cert 'CN=CA Signing Certificate'
           WARNING: BAD_CERT_DOMAIN encountered on 'CN=pki.example.com' indicates a common-name mismatch
-          Trust this certificate (y/N)? SEVERE: FATAL: SSL alert sent: BAD_CERTIFICATE
-          IOException: Unable to write to socket: Failed to write to socket: (-12276) Unable to communicate securely with peer: requested domain name does not match the server's certificate.
+          WARNING: UNKNOWN_ISSUER encountered on 'CN=pki.example.com' indicates an unknown CA cert 'CN=CA Signing Certificate'
+          Trust this certificate (y/N)? SEVERE: FATAL: SSL alert sent: ACCESS_DENIED
+          IOException: Unable to write to socket: Unable to validate CN=pki.example.com: Bad certificate domain: CN=pki.example.com
           EOF
 
           diff expected stderr
@@ -368,8 +368,8 @@ jobs:
           # check stderr
           cat > expected << EOF
           ERROR: EXPIRED_CERTIFICATE encountered on 'CN=pki.example.com' results in a denied SSL server cert!
-          SEVERE: FATAL: SSL alert sent: BAD_CERTIFICATE
-          IOException: Unable to write to socket: Failed to write to socket: (-5987) Invalid function argument.
+          SEVERE: FATAL: SSL alert sent: CERTIFICATE_EXPIRED
+          IOException: Unable to write to socket: Unable to validate CN=pki.example.com: Expired certificate: CN=pki.example.com
           EOF
 
           diff expected stderr
diff --git a/.github/workflows/tps-separate-test.yml b/.github/workflows/tps-separate-test.yml
index f16561e1043..ea8ae68832f 100644
--- a/.github/workflows/tps-separate-test.yml
+++ b/.github/workflows/tps-separate-test.yml
@@ -48,24 +48,16 @@ jobs:
         run: docker network connect example ca --alias ca.example.com
 
       - name: Install CA in CA container
+        # HTTP connector is needed in CA because if internal OCSP
         run: |
           docker exec ca pkispawn \
               -f /usr/share/pki/server/examples/installation/ca.cfg \
               -s CA \
               -D pki_ds_url=ldap://cads.example.com:3389 \
-              -D pki_http_enable=False \
               -v
 
           docker exec ca pki-server cert-find
 
-      - name: Verify there is no plain HTTP connectors in CA
-        run: |
-          docker exec ca pki-server http-connector-find | tee output
-
-          echo "Secure" > expected
-          sed -n -e "s/^ *Connector ID: *\(.*\)$/\1/p" output > actual
-          diff expected actual
-
       - name: Install banner in CA container
         run: docker exec ca cp /usr/share/pki/server/examples/banner/banner.txt /var/lib/pki/pki-tomcat/conf
 
@@ -211,11 +203,11 @@ jobs:
           sed -n -e "s/^ *Connector ID: *\(.*\)$/\1/p" output > actual
           diff expected actual
 
-      - name: Verify there is no plain HTTP ports in security domain
+      - name: Verify there is no plain HTTP ports in security domain but CA
         run: |
           docker exec ca pki-server sd-subsystem-find | tee output
 
-          echo -n "" > expected
+          echo "  Port: 8080" > expected
           sed -ne "/^ *Port:/p" output > actual
           diff expected actual
 
@@ -237,7 +229,9 @@ jobs:
           docker exec tps pki pkcs12-import \
               --pkcs12 ${SHARED}/ca_admin_cert.p12 \
               --pkcs12-password Secret.123
-          docker exec tps pki -n caadmin --ignore-banner tps-user-show tpsadmin
+
+          docker exec tps pki -n caadmin --ignore-banner \
+              tps-user-show tpsadmin
 
       - name: Gather artifacts from CA containers
         if: always()
diff --git a/base/ca/src/main/java/org/dogtagpki/server/ca/CAEngine.java b/base/ca/src/main/java/org/dogtagpki/server/ca/CAEngine.java
index d9f7dc56230..840647b9da2 100644
--- a/base/ca/src/main/java/org/dogtagpki/server/ca/CAEngine.java
+++ b/base/ca/src/main/java/org/dogtagpki/server/ca/CAEngine.java
@@ -2669,6 +2669,7 @@ private static PKIClient createPKIClient(KRAConnectorInfo connInfo) throws Excep
         }
         config.setCertNickname(nickname);
 
+        config.setCertRevocationVerify(kraConnectorConfig.getBoolean("certRevocationCheck", true));
         return new PKIClient(config);
     }
 
diff --git a/base/common/python/pki/cli/main.py b/base/common/python/pki/cli/main.py
index 6965d6d45a8..a94fc8aa3e1 100644
--- a/base/common/python/pki/cli/main.py
+++ b/base/common/python/pki/cli/main.py
@@ -67,6 +67,7 @@ def __init__(self):
         self.reject_cert_status = False
         self.ignore_cert_status = False
         self.ignore_banner = False
+        self.skip_revocation_check = False
 
         self.add_module(pki.cli.password.PasswordCLI())
         self.add_module(pki.cli.pkcs12.PKCS12CLI())
@@ -108,7 +109,9 @@ def create_parser(self, subparsers=None):
         self.parser.add_argument(
             '--ignore-banner',
             action='store_true')
-
+        self.parser.add_argument(
+            '--skip-revocation-check',
+            action='store_true')
         self.parser.add_argument(
             '-v',
             '--verbose',
@@ -173,6 +176,7 @@ def print_help(self):
         print('      --ignore-cert-status       Comma-separated list of ignored ' +
               'certificate validity statuses')
         print('      --ignore-banner            Ignore banner')
+        print('      --skip-revocation-check    Do not perform revocation check')
         print()
         print('  -v, --verbose                  Run in verbose mode.')
         print('      --debug                    Show debug messages.')
@@ -289,6 +293,9 @@ def execute_java(self, args, stdout=sys.stdout):
         if self.ignore_cert_status:
             cmd.extend(['--ignore-cert-status', self.ignore_cert_status])
 
+        if self.skip_revocation_check:
+            cmd.extend(['--skip-revocation-check'])
+
         if self.ignore_banner:
             cmd.extend(['--ignore-banner'])
 
@@ -357,6 +364,7 @@ def execute(self, argv, args=None):
         self.reject_cert_status = args.reject_cert_status
         self.ignore_cert_status = args.ignore_cert_status
         self.ignore_banner = args.ignore_banner
+        self.skip_revocation_check = args.skip_revocation_check
 
         command = None
         if len(args.remainder) > 0:
diff --git a/base/common/src/main/java/com/netscape/certsrv/client/ClientConfig.java b/base/common/src/main/java/com/netscape/certsrv/client/ClientConfig.java
index e2b2dde436c..0d582424d14 100644
--- a/base/common/src/main/java/com/netscape/certsrv/client/ClientConfig.java
+++ b/base/common/src/main/java/com/netscape/certsrv/client/ClientConfig.java
@@ -53,6 +53,8 @@ public class ClientConfig implements JSONSerializer {
 
     String messageFormat;
 
+    boolean certRevocationVerify;
+
     public ClientConfig() {
     }
 
@@ -72,6 +74,9 @@ public ClientConfig(ClientConfig config) {
         password = config.password;
 
         messageFormat = config.messageFormat;
+
+        certRevocationVerify = config.isCertRevocationVerify();
+
     }
 
     public void setServerURI(URI serverUri) {
@@ -211,6 +216,15 @@ public void setMessageFormat(String messageFormat) {
         this.messageFormat = messageFormat;
     }
 
+
+    public boolean isCertRevocationVerify() {
+        return certRevocationVerify;
+    }
+
+    public void setCertRevocationVerify(boolean certRevocationVerify) {
+        this.certRevocationVerify = certRevocationVerify;
+    }
+
     @Override
     public int hashCode() {
         final int prime = 31;
@@ -224,6 +238,7 @@ public int hashCode() {
         result = prime * result + ((serverURL == null) ? 0 : serverURL.hashCode());
         result = prime * result + ((tokenName == null) ? 0 : tokenName.hashCode());
         result = prime * result + ((username == null) ? 0 : username.hashCode());
+        result = result + (certRevocationVerify ? 0 : 1);
         return result;
     }
 
@@ -281,6 +296,8 @@ public boolean equals(Object obj) {
                 return false;
         } else if (!username.equals(other.username))
             return false;
+        if (certRevocationVerify != other.certRevocationVerify)
+            return false;
         return true;
     }
 
diff --git a/base/common/src/main/java/com/netscape/certsrv/client/PKIConnection.java b/base/common/src/main/java/com/netscape/certsrv/client/PKIConnection.java
index adbd9a2a35f..57fb00ee9e3 100644
--- a/base/common/src/main/java/com/netscape/certsrv/client/PKIConnection.java
+++ b/base/common/src/main/java/com/netscape/certsrv/client/PKIConnection.java
@@ -52,7 +52,7 @@
 import org.apache.http.message.BasicHttpResponse;
 import org.apache.http.params.HttpParams;
 import org.apache.http.protocol.HttpContext;
-import org.dogtagpki.client.DefaultSocketFactory;
+import org.dogtagpki.client.JSSSocketFactory;
 import org.jboss.resteasy.client.jaxrs.ResteasyClientBuilder;
 import org.jboss.resteasy.client.jaxrs.engines.ApacheHttpClient4Engine;
 import org.mozilla.jss.ssl.SSLCertificateApprovalCallback;
@@ -83,7 +83,7 @@ public PKIConnection(ClientConfig config) throws Exception {
         // create socket factory
         String className = System.getProperty(
                 "org.dogtagpki.client.socketFactory",
-                DefaultSocketFactory.class.getName());
+                JSSSocketFactory.class.getName());
         logger.info("PKIConnection: Socket factory: " + className);
 
         Class<? extends SchemeLayeredSocketFactory> clazz =
diff --git a/base/common/src/main/java/org/dogtagpki/client/NonBlockingSocketFactory.java b/base/common/src/main/java/org/dogtagpki/client/JSSSocketFactory.java
similarity index 91%
rename from base/common/src/main/java/org/dogtagpki/client/NonBlockingSocketFactory.java
rename to base/common/src/main/java/org/dogtagpki/client/JSSSocketFactory.java
index dab461e8fb2..b7091c17bba 100644
--- a/base/common/src/main/java/org/dogtagpki/client/NonBlockingSocketFactory.java
+++ b/base/common/src/main/java/org/dogtagpki/client/JSSSocketFactory.java
@@ -32,15 +32,18 @@
 import com.netscape.certsrv.client.PKIConnection;
 
 /**
- * This class provides non-blocking socket factory for PKIConnection.
+ * This class provides a ocket factory for PKIConnection based on JSSSocket.
+ *
+ * JSSSocket support both communication models: sync and async. The model is
+ * defined in the initial socket and if not specified it is sync.
  */
-public class NonBlockingSocketFactory implements SchemeLayeredSocketFactory {
+public class JSSSocketFactory implements SchemeLayeredSocketFactory {
 
-    public static org.slf4j.Logger logger = org.slf4j.LoggerFactory.getLogger(NonBlockingSocketFactory.class);
+    public static org.slf4j.Logger logger = org.slf4j.LoggerFactory.getLogger(JSSSocketFactory.class);
 
     PKIConnection connection;
 
-    public NonBlockingSocketFactory(PKIConnection connection) {
+    public JSSSocketFactory(PKIConnection connection) {
         this.connection = connection;
     }
 
@@ -82,7 +85,7 @@ public Socket connectSocket(Socket socket,
             JSSTrustManager trustManager = new JSSTrustManager();
             trustManager.setHostname(hostname);
             trustManager.setCallback(connection.getCallback());
-	    trustManager.setEnableCertRevokeVerify(true);
+            trustManager.setEnableCertRevokeVerify(connection.getConfig().isCertRevocationVerify());
 
             TrustManager[] tms = new TrustManager[] { trustManager };
 
diff --git a/base/common/src/main/java/org/dogtagpki/client/DefaultSocketFactory.java b/base/common/src/main/java/org/dogtagpki/client/SSLSocketFactory.java
similarity index 96%
rename from base/common/src/main/java/org/dogtagpki/client/DefaultSocketFactory.java
rename to base/common/src/main/java/org/dogtagpki/client/SSLSocketFactory.java
index a4115522269..60aed269e2d 100644
--- a/base/common/src/main/java/org/dogtagpki/client/DefaultSocketFactory.java
+++ b/base/common/src/main/java/org/dogtagpki/client/SSLSocketFactory.java
@@ -23,13 +23,13 @@
 import com.netscape.certsrv.client.PKIConnection;
 
 /**
- * This class provides blocking socket factory for PKIConnection.
+ * This class provides blocking socket factory for PKIConnection based on SSLSocket.
  */
-public class DefaultSocketFactory implements SchemeLayeredSocketFactory {
+public class SSLSocketFactory implements SchemeLayeredSocketFactory {
 
     PKIConnection connection;
 
-    public DefaultSocketFactory(PKIConnection connection) {
+    public SSLSocketFactory(PKIConnection connection) {
         this.connection = connection;
     }
 
diff --git a/base/server/etc/default.cfg b/base/server/etc/default.cfg
index d31e6235b77..2884ca20421 100644
--- a/base/server/etc/default.cfg
+++ b/base/server/etc/default.cfg
@@ -384,6 +384,7 @@ pki_request_id_length=128
 pki_security_domain_setup=True
 pki_registry_enable=True
 
+pki_kra_connector_verify_cert=True
 ###############################################################################
 ##  KRA Configuration:                                                       ##
 ##                                                                           ##
diff --git a/base/server/python/pki/server/deployment/__init__.py b/base/server/python/pki/server/deployment/__init__.py
index fe083026625..17ce9267d3e 100644
--- a/base/server/python/pki/server/deployment/__init__.py
+++ b/base/server/python/pki/server/deployment/__init__.py
@@ -1314,6 +1314,9 @@ def configure_ca(self, subsystem):
         if ocsp_uri:
             subsystem.set_config('ca.defaultOcspUri', ocsp_uri)
 
+        if not config.str2bool(self.mdict['pki_kra_connector_verify_cert']):
+            subsystem.set_config('ca.connector.KRA.certRevocationCheck', 'false')
+
     def configure_kra(self, subsystem):
 
         if config.str2bool(self.mdict['pki_use_oaep_rsa_keywrap']):
@@ -3752,6 +3755,7 @@ def issue_cert(
                 '-d', self.instance.nssdb_dir,
                 '-f', self.instance.password_conf,
                 '-U', url,
+                '--skip-revocation-check'
             ]
 
             if credentials:
@@ -4402,6 +4406,7 @@ def add_subsystem_user(
                 '-f', self.instance.password_conf,
                 '-U', subsystem_url,
                 '--ignore-banner',
+                '--skip-revocation-check',
                 '%s-user-add' % subsystem_type,
                 uid,
                 '--security-domain', sd_url,
@@ -4436,6 +4441,7 @@ def get_ca_signing_cert(self, ca_url):
             '-U', ca_url,
             '--ignore-cert-status', 'UNTRUSTED_ISSUER,UNKNOWN_ISSUER',
             '--ignore-banner',
+            '--skip-revocation-check',
             'ca-cert-signing-export',
             '--pkcs7'
         ]
@@ -4459,6 +4465,7 @@ def get_ca_subsystem_cert(self, ca_url):
             '-f', self.instance.password_conf,
             '-U', ca_url,
             '--ignore-banner',
+            '--skip-revocation-check',
             'ca-cert-subsystem-export'
         ]
 
@@ -4504,6 +4511,7 @@ def add_kra_connector(self, subsystem, ca_url):
                 '-f', self.instance.password_conf,
                 '-U', ca_url,
                 '--ignore-banner',
+                '--skip-revocation-check',
                 'ca-kraconnector-add',
                 '--url', kra_url,
                 '--subsystem-cert', subsystem_cert_file,
@@ -4578,6 +4586,7 @@ def get_kra_transport_cert(self):
             '-f', self.instance.password_conf,
             '-U', kra_url,
             '--ignore-banner',
+            '--skip-revocation-check',
             'kra-cert-transport-export'
         ]
 
@@ -4617,6 +4626,7 @@ def set_tks_transport_cert(self, cert, session=None, install_token=None):
                 '-f', self.instance.password_conf,
                 '-U', tks_url,
                 '--ignore-banner',
+                '--skip-revocation-check',
                 'tks-cert-transport-import',
                 '--security-domain', sd_url,
                 '--install-token', install_token,
@@ -4664,6 +4674,7 @@ def get_tps_connector(self, subsystem):
             '-f', self.instance.password_conf,
             '-n', nickname,
             '--ignore-banner',
+            '--skip-revocation-check',
             'tks-tpsconnector-show',
             '--host', self.mdict['pki_hostname'],
             '--port', https_port
@@ -4698,6 +4709,7 @@ def create_tps_connector(self, subsystem):
             '-f', self.instance.password_conf,
             '-n', nickname,
             '--ignore-banner',
+            '--skip-revocation-check',
             'tks-tpsconnector-add',
             '--host', self.mdict['pki_hostname'],
             '--port', https_port,
@@ -4730,6 +4742,7 @@ def get_shared_secret(self, subsystem, tps_connector_id):
             '-f', self.instance.password_conf,
             '-n', nickname,
             '--ignore-banner',
+            '--skip-revocation-check',
             'tks-key-export', tps_connector_id
         ]
 
@@ -4759,6 +4772,7 @@ def create_shared_secret(self, subsystem, tps_connector_id):
             '-f', self.instance.password_conf,
             '-n', nickname,
             '--ignore-banner',
+            '--skip-revocation-check',
             'tks-key-create', tps_connector_id,
             '--output-format', 'json'
         ]
@@ -4789,6 +4803,7 @@ def replace_shared_secret(self, subsystem, tps_connector_id):
             '-f', self.instance.password_conf,
             '-n', nickname,
             '--ignore-banner',
+            '--skip-revocation-check',
             'tks-key-replace', tps_connector_id,
             '--output-format', 'json'
         ]
diff --git a/base/server/python/pki/server/deployment/pkihelper.py b/base/server/python/pki/server/deployment/pkihelper.py
index 684494841a1..6ec7c38a3b1 100644
--- a/base/server/python/pki/server/deployment/pkihelper.py
+++ b/base/server/python/pki/server/deployment/pkihelper.py
@@ -937,6 +937,7 @@ def execute_using_pki(
                    "-d", instance.nssdb_dir,
                    "-f", password_conf,
                    "--ignore-banner",
+                   "--skip-revocation-check",
                    "tks-tpsconnector-del",
                    "--host", tpshost,
                    "--port", str(tpsport)]
diff --git a/base/server/python/pki/server/subsystem.py b/base/server/python/pki/server/subsystem.py
index cf9fba450b9..92e8dbaf91d 100644
--- a/base/server/python/pki/server/subsystem.py
+++ b/base/server/python/pki/server/subsystem.py
@@ -1494,6 +1494,7 @@ def request_range(self, master_url, range_type, session_id=None, install_token=N
                 '-f', self.instance.password_conf,
                 '-U', master_url,
                 '--ignore-banner',
+                '--skip-revocation-check',
                 '%s-range-request' % self.name,
                 range_type,
                 '--install-token', install_token,
@@ -1603,6 +1604,7 @@ def retrieve_config(self, master_url, names, substores, session_id=None, install
                 '-f', self.instance.password_conf,
                 '-U', master_url,
                 '--ignore-banner',
+                '--skip-revocation-check',
                 '%s-config-export' % self.name,
                 '--names', ','.join(names),
                 '--substores', ','.join(substores),
@@ -1764,6 +1766,7 @@ def join_security_domain(
                 '-f', self.instance.password_conf,
                 '-U', sd_url,
                 '--ignore-banner',
+                '--skip-revocation-check',
                 'securitydomain-join',
                 '--install-token', install_token,
                 '--type', self.type,
@@ -1810,6 +1813,7 @@ def leave_security_domain(
             '-n', nickname,
             '-U', sd_url,
             '--ignore-banner',
+            '--skip-revocation-check',
             'securitydomain-leave',
             '--type', self.type,
             '--hostname', hostname,
diff --git a/base/tools/src/main/java/com/netscape/cmstools/cli/MainCLI.java b/base/tools/src/main/java/com/netscape/cmstools/cli/MainCLI.java
index 4d91eae78ec..6ffb4af0f50 100644
--- a/base/tools/src/main/java/com/netscape/cmstools/cli/MainCLI.java
+++ b/base/tools/src/main/java/com/netscape/cmstools/cli/MainCLI.java
@@ -226,6 +226,9 @@ public void createOptions() throws UnknownHostException {
         option.setArgName("folder");
         options.addOption(option);
 
+        option = new Option(null, "skip-revocation-check", false, "Do not perform revocation check");
+        options.addOption(option);
+
         option = new Option(null, "reject-cert-status", true, "Comma-separated list of rejected certificate validity statuses");
         option.setArgName("list");
         options.addOption(option);
@@ -477,6 +480,7 @@ public void parseOptions(CommandLine cmd) throws Exception {
         config.setMessageFormat(messageFormat);
         logger.debug("Message format: " + messageFormat);
 
+        config.setCertRevocationVerify(!cmd.hasOption("skip-revocation-check"));
         optionsParsed = true;
     }
 
diff --git a/docs/changes/v11.7.0/Server-Changes.adoc b/docs/changes/v11.7.0/Server-Changes.adoc
index 439a7e3eb16..f91953cdbaa 100644
--- a/docs/changes/v11.7.0/Server-Changes.adoc
+++ b/docs/changes/v11.7.0/Server-Changes.adoc
@@ -21,3 +21,9 @@ Name will not change.
 Standalone OCSP ResponderID has changed the default value from Subject
 name to Key hash. Running instance usinf DefStore will keep their
 current configuration.
+
+== Add ca.connector.KRA.certRevocationCheck parameter ==
+
+A new `CS.cfg` parameter `ca.connector.KRA.certRevocationCheck` has
+been added to enable/disable the certificate revocation check for the
+CA acting as KRA client. The default value is `true`.
diff --git a/docs/changes/v11.7.0/Tools-Changes.adoc b/docs/changes/v11.7.0/Tools-Changes.adoc
index 9390b766187..a3ba1200d25 100644
--- a/docs/changes/v11.7.0/Tools-Changes.adoc
+++ b/docs/changes/v11.7.0/Tools-Changes.adoc
@@ -3,3 +3,21 @@
 == Deprecate tpsclient ==
 
 `tpsclient` has been deprecated. Use `pki tps-client` instead.
+
+== New --skip-revocation-check option in pki ==
+
+`pki` command has been modified to use JSSSocket. This enable by
+default revocation check of server certificates, either with AIA or
+CRL-DP. The new option `--skip-revocation-check` allows to skip the
+check in situation where the OCSP server or the CRLs cannot be
+accessed.
+
+Alternatively, the revocation check will still happen, but the
+generated error can be ignored using the option `--ignore-cert-status`
+and the reported status error.
+
+== New pkispawn option pki_kra_connector_verify_cert ==
+
+The CA parameter `pki_kra_connector_verify_cert` set corresponding
+`CS.cfg` paramater `ca.connector.KRA.certRevocationCheck` for KRA
+connector. The default value is `True`.


Reviews:
user: login: edewata
body: The code changes are good, but as discussed on Slack I'm a bit concerned because some tests have to be changed to use the `--ignore-...` or `--skip-...` options, so it might cause problems for QE automation and end users as well.

I think if we know for certain that this is only affecting a limited set of scenarios (i.e. QE might need to update some tests but not all), we probably can merge it if QE is OK with that.

If this is affecting many of scenarios, I'd suggest to wait until we resolve the actual issue with revocation checking.

Alternatively, we probably can disable the revocation checking by default so the behavior is the same as before. Once we resolve the actual issue with revocation checking we can change the default.

state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-28T19:23:35Z
user: login: edewata
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-31T16:01:53Z
user: login: fmarco76
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-03-31T16:12:39Z
user: login: edewata
body: Thanks for the update! I do have some additional comments. I think we need @ladycfu's input here.
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-03T20:45:24Z
user: login: fmarco76
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-04-04T09:06:13Z
user: login: fmarco76
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-04-04T09:06:26Z
user: login: fmarco76
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-04-04T10:55:41Z
user: login: fmarco76
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-04-04T11:19:31Z
user: login: edewata
body: Thanks for the update! I have some additional comments, but I think this looks good. Feel free to merge if there's no other objections.
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-04-04T15:44:25Z
user: login: ladycfu
body: LGTM.  Only **two minor change suggestions**.  Feel free to update and merge.
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-04-04T21:16:45Z

Review comments:
diff_hunk: @@ -109,6 +109,7 @@ jobs:
           # enrollment should fail
           docker exec pki pki \
               -n caadmin \
+              --ignore-cert-status OCSP_SERVER_ERROR \
path: .github/workflows/ca-ds-connection-test.yml
user: login: edewata
body: I'm wondering if we should set up a separate OCSP server with it's own DS so that it's not affected by CA DS shutdown which is what we're primarily trying to test here.
created_at: 2025-03-31T16:01:53Z
author_association: CONTRIBUTOR
diff_hunk: @@ -109,6 +109,7 @@ jobs:
           # enrollment should fail
           docker exec pki pki \
               -n caadmin \
+              --ignore-cert-status OCSP_SERVER_ERROR \
path: .github/workflows/ca-ds-connection-test.yml
user: login: fmarco76
body: I guess this could be a scenario also for IPA so it is OK to test with internal OCSP
created_at: 2025-03-31T16:12:39Z
author_association: MEMBER
diff_hunk: @@ -271,6 +271,7 @@ jobs:
           docker exec pki pki \
               -u caadmin \
               -w Secret.123 \
+              --ignore-cert-status REVOKED_CERTIFICATE \
path: .github/workflows/ca-renewal-system-certs-hsm-test.yml
user: login: edewata
body: Should this be `EXPIRED_CERTIFICATE` since we're testing with expired certs?
created_at: 2025-04-03T20:09:48Z
author_association: CONTRIBUTOR
diff_hunk: @@ -234,6 +234,7 @@ jobs:
           docker exec pki pki \
               -u caadmin \
               -w Secret.123 \
+              --ignore-cert-status REVOKED_CERTIFICATE \
path: .github/workflows/ca-renewal-system-certs-test.yml
user: login: edewata
body: Same thing, should this be `EXPIRED_CERTIFICATE`?
created_at: 2025-04-03T20:10:33Z
author_association: CONTRIBUTOR
diff_hunk: @@ -187,7 +188,7 @@ jobs:
           docker exec ipa pki nss-cert-show ipa-ca-agent
 
           # CA admin should be able to access PKI users
-          docker exec ipa pki -n ipa-ca-agent ca-user-find
+          docker exec ipa pki -n ipa-ca-agent --skip-revocation-check ca-user-find
path: .github/workflows/ipa-renewal-test.yml
user: login: edewata
body: I think we should use `--ignore-cert-status EXPIRED_CERTIFICATE` since we're trying to fix an expired cert. If the cert is actually revoked we do want the client to know that (i.e. the command should fail).
created_at: 2025-04-03T20:15:14Z
author_association: CONTRIBUTOR
diff_hunk: @@ -21,3 +21,9 @@ Name will not change.
 Standalone OCSP ResponderID has changed the default value from Subject
 name to Key hash. Running instance usinf DefStore will keep their
 current configuration.
+
+== Add pki_client_verify_cert parameter ==
+
+A new parameter `pki_client_verify_cert` has been added to
+enable/disable the certificate revocation check for the CA acting as
+client. The default value is `False` which disables the check.
path: docs/changes/v11.7.0/Server-Changes.adoc
user: login: edewata
body: We have other `pki_client_*` params but they are mainly used to provide the client credentials for the admin user, so the new param could be confusing. Could we use something like `pki_connector_verify_cert` or `pki_kra_connector_verify_cert`?
created_at: 2025-04-03T20:24:02Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1314,6 +1314,9 @@ def configure_ca(self, subsystem):
         if ocsp_uri:
             subsystem.set_config('ca.defaultOcspUri', ocsp_uri)
 
+        if config.str2bool(self.mdict['pki_client_verify_cert']):
+            subsystem.set_config('ca.clientRevocationCheck', 'true')
path: base/server/python/pki/server/deployment/__init__.py
user: login: edewata
body: Could we use something like `ca.certRevocationCheck` instead to avoid confusion, or maybe move it to the connector configuration (e.g. `ca.connector.KRA.certRevocationCheck`)?

created_at: 2025-04-03T20:28:13Z
author_association: CONTRIBUTOR
diff_hunk: @@ -237,7 +229,10 @@ jobs:
           docker exec tps pki pkcs12-import \
               --pkcs12 ${SHARED}/ca_admin_cert.p12 \
               --pkcs12-password Secret.123
-          docker exec tps pki -n caadmin --ignore-banner tps-user-show tpsadmin
+
+          #TODO: certificate not accepted with this setup
+          docker exec tps pki -n caadmin --ignore-banner \
+              tps-user-show tpsadmin
path: .github/workflows/tps-separate-test.yml
user: login: edewata
body: Is the TODO still needed?
created_at: 2025-04-03T20:29:18Z
author_association: CONTRIBUTOR
diff_hunk: @@ -277,16 +277,19 @@ jobs:
 
       - name: Check CA admin user again
         run: |
+          #TODO: after migration the OCSPServlet is failing and has to be fixed
path: .github/workflows/ca-container-existing-config-test.yml
user: login: edewata
body: Is there a ticket for this issue? Could you add the link into the comment?
created_at: 2025-04-03T20:31:04Z
author_association: CONTRIBUTOR
diff_hunk: @@ -163,8 +165,10 @@ jobs:
           sleep 60
 
           # enrollment should work
+          # OCSP is not working because he authorityMonitor is disabled
path: .github/workflows/ca-ds-connection-test.yml
user: login: edewata
body: I think this is another issue with `AuthorityMonitor`, basically if cannot be disabled without causing issues somewhere elase.
created_at: 2025-04-03T20:35:07Z
author_association: CONTRIBUTOR
diff_hunk: @@ -384,6 +384,8 @@ pki_request_id_length=128
 pki_security_domain_setup=True
 pki_registry_enable=True
 
+pki_client_verify_cert=False
path: base/server/etc/default.cfg
user: login: edewata
body: I think we should disable revocation check only if it's causing a chicken and egg problem (e.g. installing CA with certs pointing to its built-in OCSP) so I'm not sure if we should apply the same default policy for all installation cases.
created_at: 2025-04-03T20:40:48Z
author_association: CONTRIBUTOR
diff_hunk: @@ -271,6 +271,7 @@ jobs:
           docker exec pki pki \
               -u caadmin \
               -w Secret.123 \
+              --ignore-cert-status REVOKED_CERTIFICATE \
path: .github/workflows/ca-renewal-system-certs-hsm-test.yml
user: login: fmarco76
body: This error is generated by checking the validity of temporary `sslserver` certificate. In line 211 above it was verified the expired `sslserver` and the error was `EXPIRED_CERTIFICATE` as expected. Then it is replaced with a temporary certificate which is valid and not revoked but all the subsystem certificates have expired, including the `ocsp_signing` certificate. Therefore, testing the temporary `sslserver` certificate it is valid and good but the validation failed because the OCSP certificate has expired. As a result the certificate is considered REVOKED because our policy is to consider the certificate revoked if validation fails.
created_at: 2025-04-04T09:06:13Z
author_association: MEMBER
diff_hunk: @@ -234,6 +234,7 @@ jobs:
           docker exec pki pki \
               -u caadmin \
               -w Secret.123 \
+              --ignore-cert-status REVOKED_CERTIFICATE \
path: .github/workflows/ca-renewal-system-certs-test.yml
user: login: fmarco76
body: As above.
created_at: 2025-04-04T09:06:26Z
author_association: MEMBER
diff_hunk: @@ -384,6 +384,8 @@ pki_request_id_length=128
 pki_security_domain_setup=True
 pki_registry_enable=True
 
+pki_client_verify_cert=False
path: base/server/etc/default.cfg
user: login: fmarco76
body: I have update to true. With latest changes to default OCSP there are no problem in workflows.
created_at: 2025-04-04T10:55:41Z
author_association: MEMBER
diff_hunk: @@ -277,16 +277,19 @@ jobs:
 
       - name: Check CA admin user again
         run: |
+          #TODO: after migration the OCSPServlet is failing and has to be fixed
path: .github/workflows/ca-container-existing-config-test.yml
user: login: fmarco76
body: It is the same problem with the AuthorityMonitor present with other containers workflows.
created_at: 2025-04-04T11:19:31Z
author_association: MEMBER
diff_hunk: @@ -277,16 +277,19 @@ jobs:
 
       - name: Check CA admin user again
         run: |
+          #TODO: after migration the OCSPServlet is failing and has to be fixed
path: .github/workflows/ca-container-existing-config-test.yml
user: login: edewata
body: I see, `AuthorityMonitor` is indeed not compatible with containers, but if it's disabled it's breaking other things, and we just discovered that since we're enabling revocation checking. Could you maybe change the comment like this: OCSPServlet fails since AuthorityMonitor is disabled in container?
created_at: 2025-04-04T15:32:00Z
author_association: CONTRIBUTOR
diff_hunk: @@ -271,6 +271,7 @@ jobs:
           docker exec pki pki \
               -u caadmin \
               -w Secret.123 \
+              --ignore-cert-status REVOKED_CERTIFICATE \
path: .github/workflows/ca-renewal-system-certs-hsm-test.yml
user: login: edewata
body: I think the "revoked" status is misleading since there's nothing actually revoked, but we can table that for another time. Do you mind adding your explanation as a comment above this line?
created_at: 2025-04-04T15:39:12Z
author_association: CONTRIBUTOR
diff_hunk: @@ -163,8 +165,10 @@ jobs:
           sleep 60
 
           # enrollment should work
+          # OCSP is not working because he authorityMonitor is disabled
path: .github/workflows/ca-ds-connection-test.yml
user: login: ladycfu
body: typo: 'he' -> 'the'
created_at: 2025-04-04T17:42:01Z
author_association: CONTRIBUTOR
diff_hunk: @@ -3,3 +3,20 @@
 == Deprecate tpsclient ==
 
 `tpsclient` has been deprecated. Use `pki tps-client` instead.
+
+== New --skip-revocation-check option in pki ==
+
+`pki` command has been modified to use JSSSocket. This enable by
+default revocation check of server certificates, either with AIA or
+CRL-DP. The new option `--skip-revocation-check` allows to skip the
+check in situation where the OCSP server or the CRLs cannot be
+accessed.
+
+Alternatively, the generated error can be ignored using the option
path: docs/changes/v11.7.0/Tools-Changes.adoc
user: login: ladycfu
body: **Alternatively, the revocation check will still happen, but** the generated error can be ignored using the option
created_at: 2025-04-04T21:05:36Z
author_association: CONTRIBUTOR

PR comments:
user: login: fmarco76
created_at: 2025-03-28T11:01:04Z
body: @rcritten   with this update the client validate certificate but IPA is not making available the OCSP endpoint, or at least in the configuration here. For this and other problem, at moment the verification is disabled during installation and in the CA when acting as client. Could OCSP be enabled in IPA?
Additionally, I have disabled in all the installation scenarios I have tried but some cases could fail so it need to be verified.

If IPA uses pki clients for some operation this should be taken in account.
author_association: MEMBER
user: login: fmarco76
created_at: 2025-04-03T18:27:54Z
body: @edewata after #5026 the only problem are with the ActivityMonitor which will be fixed in other PRs. The remaining skips are related to situation where expired/revoked certificate are expected. Do we miss cases? 

`pkispawn` during installation does not check certificates, should it have an option to enable? (like the CA acting which  acting as a client does not check by default but there is the option to enable).
author_association: MEMBER
user: login: sonarqubecloud[bot]
created_at: 2025-04-04T17:12:23Z
body: ## [![Quality Gate Passed](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/QualityGateBadge/qg-passed-20px.png 'Quality Gate Passed')](https://sonarcloud.io/dashboard?id=dogtagpki_pki&pullRequest=5021) **Quality Gate passed**  
Issues  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [9 New issues](https://sonarcloud.io/project/issues?id=dogtagpki_pki&pullRequest=5021&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/accepted-16px.png '') [0 Accepted issues](https://sonarcloud.io/project/issues?id=dogtagpki_pki&pullRequest=5021&issueStatuses=ACCEPTED)

Measures  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=dogtagpki_pki&pullRequest=5021&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0.0% Coverage on New Code](https://sonarcloud.io/component_measures?id=dogtagpki_pki&pullRequest=5021&metric=new_coverage&view=list)  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0.7% Duplication on New Code](https://sonarcloud.io/component_measures?id=dogtagpki_pki&pullRequest=5021&metric=new_duplicated_lines_density&view=list)  
  
[See analysis details on SonarQube Cloud](https://sonarcloud.io/dashboard?id=dogtagpki_pki&pullRequest=5021)


author_association: NONE
user: login: fmarco76
created_at: 2025-04-07T08:00:58Z
body: @edewata @ladycfu Thanks!
author_association: MEMBER