swedenconnect/ca-engine

Library for an Open Source Certificate Authority

ca-engine's Issues

Upgrade commons-beanutils

A transitive dependency on commons-beanutils has vulnerabilities and should be upgraded from 1.9.3 to the fixed version 1.9.4.

The source of this dependency comes from org.jvnet.jaxb2_commons:jaxb2-basics-tools:0.12.0, which in turn comes from se.swedenconnect.schemas.cert:authcontextinfo10-jaxb:2.0.0

Use PkiCredential instead of private keys directly

By doing so, we ensure that we can use monitoring and reloading when using HSM:s.

CertificateIssuanceException should extend CertificateException

As it is now it extends IOException. It makes more sense to extend CertificateException. What's IO-related with an error during certificate issuance?

getKeyIdentifierExtensionsModels in AbstractCertificateModelBuilder is really a setter/updater

Confusing

Port to Java 17/Jakarta

Port to Java 17/Jakarta

Update credential-support version

A new version of credential support is available which allows unlimited updates to the certificate chain.

When updating to this version The ExternalChainCredential added in 1.2.2 should be deleted again.
Implementations using 1.2.2 should use the latest version of credential-support and should NOT use ExternalChainCredential.

Use Duration in CertificateIssuerModel

The configuration right now is a bit confusing ...

build method of AbstractCertificateModelBuilder should not be abstract

It kind of ruins the whole idea ...

Releasing certificate from certificateHold status

A certificate with status certificateHold can be revoked several times using the provided storage API. However there is no way to remove a certificate with certificateHold status from being revoked.

This requires an update to the current API.

The proposed resolution is that a reason code of -1 in the API call should cause the certificate to be removed from revocation if the status is certificate hold.

This requires no API changes, only a documentation update.

Method publishNewCrl in CRLRevocationDataProvider should have a throws declaration

There are a lot of thing that may go wrong. Let's not be silent about it.

junit-jupiter-engine is not scoped as test

Which leads to that this test jar is a compile dependency.