Fwd: Re: [Pulp-list] Candlepin and Certificate Revocation

[Bryan Kearney]

James.. thoughts?

-- bk

-------- Original Message --------
Subject: Re: [Pulp-list] Candlepin and Certificate Revocation
Date: Thu, 21 Jul 2011 11:55:46 -0400
From: Bryan Kearney 
To: Jason L Connor 
CC: [e-mail]

On 07/21/2011 11:24 AM, Jason L Connor wrote:
> Disclaimer: I haven't done any work with Candlepin integration or even
> our certificate based authorization. So this email is going to be a
> bunch of "thinking out loud", if you will.
>
> It looks like the functionality is boiling down to batch vs single
> certificate revocation.

well..  batch transmission of data, still checking per request to pulp
> In either case I prefer standards compliance over non-, so I don't like
> the custom option.

+1
> I guess it's a trade off of how fine-grained, time-wise, we want
> certificate revocation to be vs. how much do we want to talk over the
> network.

I think we can live with daily, or perhaps every 6 hours or so.
> I like the batch operation (CRL) as it doesn't need to check the status
> of a certificate with candlepin at the same time as fielding a request
> from a client. However, depending on how often the revocation list is
> generated, the information pulp has at any given time for a certificate
> may be out of date.
>
> If we can keep the time granularity on certificate revocation
> sufficiently coarse or we're willing to live with sufficiently short
> periods of time in which we have dated certificate information, I think
> this solution is the best.
>
> If we cannot, we should move to OCSP.

I am fine with CRL if you guys are. Lemme check with the thumbslug folks.

-- bk

_______________________________________________
Pulp-list mailing list
[e-mail]
https://www.redhat.com/mailman/listinfo/pulp-list

[James Bowes]

On Thu, Jul 21, 2011 at 11:56:48AM -0400, Bryan Kearney wrote:
> James.. thoughts?
>
> -- bk

CRL works for me. now, otoh, thumbslug has to call home to candlepin to
get the matching upstream cert for whatever client cert was used, before
we can forward the request, so as I think of it, that might just be able
to handle the revocation for us. No matching upstream cert response =
client cert has been revoke.

If we cache the upstream certs on thumbslug though, we might need the
CRL, too. Regardless, CRL sounds good. Less complicated than OCSP ;)
> -------- Original Message --------
> Subject: Re: [Pulp-list] Candlepin and Certificate Revocation
> Date: Thu, 21 Jul 2011 11:55:46 -0400
> From: Bryan Kearney 
> To: Jason L Connor 
> CC: [e-mail]
>
> On 07/21/2011 11:24 AM, Jason L Connor wrote:
> > Disclaimer: I haven't done any work with Candlepin integration or even
> > our certificate based authorization. So this email is going to be a
> > bunch of "thinking out loud", if you will.
> >
> > It looks like the functionality is boiling down to batch vs single
> > certificate revocation.
>
> well..  batch transmission of data, still checking per request to pulp
> > In either case I prefer standards compliance over non-, so I don't like
> > the custom option.
>
> +1
> > I guess it's a trade off of how fine-grained, time-wise, we want
> > certificate revocation to be vs. how much do we want to talk over the
> > network.
>
> I think we can live with daily, or perhaps every 6 hours or so.
> > I like the batch operation (CRL) as it doesn't need to check the status
> > of a certificate with candlepin at the same time as fielding a request
> > from a client. However, depending on how often the revocation list is
> > generated, the information pulp has at any given time for a certificate
> > may be out of date.
> >
> > If we can keep the time granularity on certificate revocation
> > sufficiently coarse or we're willing to live with sufficiently short
> > periods of time in which we have dated certificate information, I think
> > this solution is the best.
> >
> > If we cannot, we should move to OCSP.
>
> I am fine with CRL if you guys are. Lemme check with the thumbslug folks.
>
> -- bk
>
> Pulp-list mailing list
> [e-mail]
> https://www.redhat.com/mailman/listinfo/pulp-list
> _______________________________________________
> candlepin mailing list
> [e-mail]
> https://fedorahosted.org/mailman/listinfo/candlepin

-James

[Bryan Kearney]

On 07/21/2011 01:34 PM, James Bowes wrote:
> On Thu, Jul 21, 2011 at 11:56:48AM -0400, Bryan Kearney wrote:
> > James.. thoughts?
> >
> > -- bk
>
> CRL works for me. now, otoh, thumbslug has to call home to candlepin to
> get the matching upstream cert for whatever client cert was used, before
> we can forward the request, so as I think of it, that might just be able
> to handle the revocation for us. No matching upstream cert response =
> client cert has been revoke.
>
> If we cache the upstream certs on thumbslug though, we might need the
> CRL, too. Regardless, CRL sounds good. Less complicated than OCSP ;)

ok.. crl it is. Assume CP will write it out to known location. ts/pulp 
do the needeful to monitor and reload.

-- bk