Uploaded image for project: 'EJBCA'
  1. EJBCA
  2. ECA-8167

Possibility to issue a final CRL with unlimited end date 99991231235959Z

    Details

    • Type: Improvement
    • Status: Closed
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: None
    • Fix Version/s: EJBCA 7.2.0
    • Component/s: None
    • Provenance:
      Ordered by Customer
    • Issue discovered during:
      Customer
    • Sprint:
      EJBCA Team Alice - 2019 w18

      Description

      This is a compliance issue for eIDAS TSPs. ETSI EN 319 411-2 and -1

      https://www.etsi.org/deliver/etsi_en/319400_319499/31941102/02.02.02_60/en_31941102v020202p.pdf

      https://www.etsi.org/deliver/etsi_en/319400_319499/31941101/01.02.02_60/en_31941101v010202p.pdf

       

      319 411-2: CSS-6.3.10-07

      CRLs are provided and the TSP decides or is required to terminate a CRL, the TSP should issue and publish at the corresponding CRL Distribution Point a last CRL with a nextUpdate field value as defined in ETSI EN 319 411-1 [2], clause 6.3.9. Requirement CSS-6.3.9-06.

       

      Today we can set CRL Period really high, but it will not stop at 99991231235959Z, but produce larger dates (displayed as invalid date in "openssl crl").

      The easy fix is to put a check in CRL generation, if the nextUpdate is calculated to be >99991231235959Z, set it to 99991231235959Z. Then setting CRL period to 9999y (for example) will create this CRL.

      • modify CRL generation in X509CAImpl
      • make JUnit test to verify both normal and final CRL period
      • update documentation (which is reached by clicking the ? for the CRL Period Edit CA setting

       

       

        Attachments

          Issue Links

            Activity

              People

              Assignee:
              tomas Tomas Gustavsson
              Reporter:
              mikek Mike Agrenius Kushner
              Verified by:
              Henrik Sunmark
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved:

                  Time Tracking

                  Estimated:
                  Original Estimate - 4 hours
                  4h
                  Remaining:
                  Time Spent - 3 hours, 20 minutes Remaining Estimate - 40 minutes
                  40m
                  Logged:
                  Time Spent - 3 hours, 20 minutes Remaining Estimate - 40 minutes
                  3h 20m