candlepin/candlepin — pull request #44 by jmrodri (2012-08-22 02:38:16+00:00)
Title: Add ability to remove a cert from the certificate revocation list (CRL).

Quite a bit of refactoring had to occur and a few bug fixes in the process.

* CrlGenerator:
* Renamed updateCRL to syncCRLWithDB
* removed createCRL() which was useless
* added removeEntries(X509CRL, List)

* CertificateSerialCurator
* added listBySerialIds method

* BouncyCastlePKIUtility
* added warning suppression because of all the YELLOW warnings

* CrlResource
* new unrevoke() method that takes in a list of certificate serial ids

* CertifiateRevocationListTask
* simplified the logic a bit: readCRL, sync, writefile

* CRLFileUtil
* broke apart the updateCRL method into more meaningful methods
* added X509CRL readCRLFile(File) to read in the contents of the
existing crl (or return an empty one)
* added byte[] writeCRLFile(File, X509CRL) which will write the given
CRL to the given File and return a PEM encoded copy of the CRL in
case the callers needs it for any reason.

TESTING
---------------
To test this do the following:
* register a consumer to candlepin.
* Subscribe it to a pool.
* Take note of the entitlement number: ls /etc/pki/entitlements/*.pem (you'll need it later)
* Get your consumer uuid
* Delete the entitlements for that consumer:
curl -k -u admin:admin -X DELETE https://localhost:8443/candlepin/consumers/UUID/entitlements/
* get the current CRL to see how many records are there.
curl -k -u admin:admin https://localhost:8443/candlepin/crl > current.crl
Using openssl crl -text -in current.crl you can verify our certificate is in the crl
* Now remove the cert serial from the CRL:
curl -k -u admin:admin -X DELETE https://localhost:8443/candlepin/crl/?sid=ENTITLEMENT_ID_FROM_ABOVE
* get the current CRL to see how many records are there.
curl -k -u admin:admin https://localhost:8443/candlepin/crl > new.crl
Using openssl crl -text -in new.crl you can verify our certificate is in the crl