Revoking a certificate does not work

[OliverSCE]

Revoking a certificate does not work

[OliverSCE]

Just verified: I also doesn't work with any other certificate.

[hakwerk]

I haven't tested it myself yet, but probably the fix is to change this line in /home/labca/labca/commander from

docker compose exec boulder bin/admin-revoker serial-revoke --config labca/config/admin-revoker.json $serial $reasonCode 2>&1

to

docker compose exec boulder bin/admin -config labca/config/admin.json revoke-cert -serial $serial -reason $reasonCode 2>&1

[OliverSCE]

The error message changes now. It first gives a server error, an the labca log states:

2024-07-09T16:22:53.924487+00:00Z admin[1008]: 3 admin ntOk6wg [AUDIT] executing subcommand: got unacceptable revocation reason "5"
gui-1 | 2024-07-09T16:22:53.924457+00:00Z admin[1008]: 6 admin gqfPqws [AUDIT] admin tool executing a dry-run with the following arguments: "bin/admin -config labca/config/admin.json revoke-cert -serial 7fb2d308a535cc7d5453b2c40fcd2456d364 -reason 5"

[OliverSCE]

Update: hardcoding the reason "superseeded" into the command does seems to be ok, but only does a dry run:

gui-1 | 2024-07-09T16:29:07.703065+00:00Z admin[1022]: 6 admin 983jqAM [AUDIT] admin tool executing a dry-run with the following arguments: "bin/admin -config labca/config/admin.json revoke-cert -serial 7fb2d308a535cc7d5453b2c40fcd2456d364 -reason superseded"
gui-1 | 2024-07-09T16:29:07.703089+00:00Z admin[1022]: 6 admin 6MX16g0 Found 1 certificates to revoke
gui-1 | 2024-07-09T16:29:07.703847+00:00Z admin[1022]: 6 admin oN-h9wY dry-run: "serial:"7fb2d308a535cc7d5453b2c40fcd2456d364" code:4 adminName:"root""
gui-1 | 2024-07-09T16:29:07.703879+00:00Z admin[1022]: 6 admin 9_mC6gM [AUDIT] admin tool has successfully completed executing a dry-run with the following arguments: "bin/admin -config labca/config/admin.json revoke-cert -serial 7fb2d308a535cc7d5453b2c40fcd2456d364 -reason superseded"
gui-1 | 2024-07-09T16:29:07.703894+00:00Z admin[1022]: 6 admin 7tT7rAY Dry run complete. Pass -dry-run=false to mutate the database.'

Adding "-dry-run=false" to the command does the trick, but not sure if this breaks something else.

[hakwerk]

Thanks for the info! I will have a better look when I find some time

... but not sure if this breaks something else.

I expect it will be totally fine, but I need to have a better look at it

[OliverSCE]

You are probably right, so far it seems to be totally fine, except that the revoke reason is hardwired in the command file.