From 9b230fad28f41cfddf633cf8a9cc63d650b01cca Mon Sep 17 00:00:00 2001 From: Bastien Diederichs Date: Tue, 30 Jun 2026 09:54:18 +0200 Subject: [PATCH] Use /crl/pem instead of /crl/der to fetch CRLs --- example/actions/revoke-certificate.sh | 5 ++++- src/scripts/orca-protocol/sudoer/export_crls.nix | 5 ++++- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/example/actions/revoke-certificate.sh b/example/actions/revoke-certificate.sh index 37fcce5..ba4f6b6 100755 --- a/example/actions/revoke-certificate.sh +++ b/example/actions/revoke-certificate.sh @@ -30,4 +30,7 @@ vault write ${PKI_NAME}/revoke \ CRL_DIR="$AIA_FOLDER/$PKI_NAME/issuer/$ISSUER_ID/crl" mkdir -p $CRL_DIR -vault read -format=raw $PKI_NAME/issuer/$ISSUER_ID/crl/der > $CRL_DIR/der +# We use `/crl/pem` instead of `/crl/der`, as the latter seems to show inconsistent behavior in its output, see https://github.com/hashicorp/vault/issues/32018 +vault read -format=raw $PKI_NAME/issuer/$ISSUER_ID/crl/pem > $CRL_DIR/pem +openssl crl -outform der -in $CRL_DIR/pem -out $CRL_DIR/der +rm $CRL_DIR/pem diff --git a/src/scripts/orca-protocol/sudoer/export_crls.nix b/src/scripts/orca-protocol/sudoer/export_crls.nix index 9b36a74..d02f0fb 100644 --- a/src/scripts/orca-protocol/sudoer/export_crls.nix +++ b/src/scripts/orca-protocol/sudoer/export_crls.nix @@ -19,7 +19,10 @@ in CRL_DIR="$PKI_AIA_DIR/crl" mkdir -p $CRL_DIR vault read -format=raw ''${PKI_NAME}/issuer/$ISSUER_ID/der > $PKI_AIA_DIR/der - vault read -format=raw ''${PKI_NAME}/issuer/$ISSUER_ID/crl/der > $CRL_DIR/der + # We use `/crl/pem` instead of `/crl/der`, as the latter seems to show inconsistent behavior in its output, see https://github.com/hashicorp/vault/issues/32018 + vault read -format=raw ''${PKI_NAME}/issuer/$ISSUER_ID/crl/pem > $CRL_DIR/pem + openssl crl -outform der -in $CRL_DIR/pem -out $CRL_DIR/der + rm $CRL_DIR/pem fi done done