fix(ocsp): renew the delegated responder certificate after a CA re-key (#386)

A CA key rotation swaps the CA key and certificate but left the stored
delegated OCSP responder in place. It was still fresh, so ensure kept
serving it, and responses for leaves under the new key were signed by a
responder that chains to the discarded key.

loadStored now also checks the stored responder is signed by the current
CA certificate and re-mints it when it isn't. The renewal ticker picks
that up within 30 seconds of submit-rotation, or the first OCSP request
does.

Closes #383

Signed-off-by: Bugs5382 <12115015+Bugs5382@users.noreply.github.com>
Co-authored-by: Bugs5382 <12115015+Bugs5382@users.noreply.github.com>

Author: Bugs5382

internal/init/ocsp_responder.go

@@ -23,6 +23,7 @@ import (
 	"crypto/x509/pkix"
 	"encoding/asn1"
 	"fmt"
+	"log"
 	"time"
 
 	"github.com/CryptOS-PKI/cryptos-node/internal/ca"
@@ -100,8 +101,14 @@ func (r *ocspResponder) ensure(ctx context.Context) (*x509.Certificate, crypto.S
 }
 
 // loadStored returns the persisted responder cert+key when one exists, parses,
-// and is still outside the renewal window. Any failure (absent, unparsable,
-// expiring) reports ok=false so the caller re-mints.
+// was signed by the current CA certificate, and is still outside the renewal
+// window. Any failure (absent, unparsable, signed by another key, expiring)
+// reports ok=false so the caller re-mints.
+//
+// The signature check is what renews the responder after a CA re-key: the
+// rotation swaps the CA key and certificate but leaves the stored responder,
+// still fresh, signed by the discarded key, and a client checking against the
+// new CA certificate rejects responses it signs (#383).
 //
 // The window is half the lifetime a re-mint could actually get: ca.Sign caps
 // the responder at the issuer's notAfter, so once the issuer has less than the
@@ -118,6 +125,11 @@ func (r *ocspResponder) loadStored(ctx context.Context) (*x509.Certificate, cryp
 	}
 	achievable := r.validity
 	if issuer, err := r.issuer(ctx); err == nil && issuer != nil {
+		if err := cert.CheckSignatureFrom(issuer); err != nil {
+			log.Printf("OCSP responder: stored certificate (serial %s) is not signed by the current CA certificate, re-minting: %v",
+				cert.SerialNumber.Text(16), err)
+			return nil, nil, false
+		}
 		achievable = min(achievable, time.Until(issuer.NotAfter))
 	}
 	remaining := time.Until(cert.NotAfter)

internal/init/ocsp_responder_test.go

@@ -25,10 +25,13 @@ import (
 	"crypto/rsa"
 	"crypto/x509"
 	"crypto/x509/pkix"
+	"math/big"
 	"sync"
 	"testing"
 	"time"
 
+	"golang.org/x/crypto/ocsp"
+
 	"github.com/CryptOS-PKI/cryptos-node/internal/ca"
 	"github.com/CryptOS-PKI/cryptos-node/internal/node"
 	"github.com/CryptOS-PKI/cryptos-node/internal/storage/etcd"
@@ -176,6 +179,73 @@ func TestOCSPResponderEnsureReusesFresh(t *testing.T) {
 	}
 }
 
+// After a CA re-key the stored responder is still fresh, but it was signed by
+// the discarded key. Responses for the new key's leaves have to chain to the
+// new CA certificate, so the responder must be re-minted under the new key
+// (#383).
+func TestOCSPResponderRemintsAfterCAReKey(t *testing.T) {
+	f, mgr, ctx := newOCSPResponderFixture(t, 7*24*time.Hour)
+
+	before, _, err := mgr.ensure(ctx)
+	if err != nil {
+		t.Fatalf("ensure before re-key: %v", err)
+	}
+
+	newKey, err := ecdsa.GenerateKey(elliptic.P384(), rand.Reader)
+	if err != nil {
+		t.Fatalf("GenerateKey new CA key: %v", err)
+	}
+	p := ca.Profile{
+		Subject:   f.issuer.Subject,
+		NotBefore: time.Now().Add(-time.Minute),
+		NotAfter:  time.Now().Add(5 * 365 * 24 * time.Hour),
+		IsCA:      true,
+		KeyUsage:  x509.KeyUsageCertSign | x509.KeyUsageCRLSign,
+	}
+	der, _, err := ca.Sign(p, newKey.Public(), nil, newKey)
+	if err != nil {
+		t.Fatalf("ca.Sign re-keyed issuer: %v", err)
+	}
+	newIssuer, err := x509.ParseCertificate(der)
+	if err != nil {
+		t.Fatalf("ParseCertificate re-keyed issuer: %v", err)
+	}
+	f.issuer, f.caKey = newIssuer, newKey
+
+	after, afterKey, err := mgr.ensure(ctx)
+	if err != nil {
+		t.Fatalf("ensure after re-key: %v", err)
+	}
+	if after.SerialNumber.Cmp(before.SerialNumber) == 0 {
+		t.Fatal("ensure kept the responder signed by the old CA key")
+	}
+	if err := after.CheckSignatureFrom(newIssuer); err != nil {
+		t.Fatalf("responder does not chain to the re-keyed CA: %v", err)
+	}
+
+	respDER, err := ocsp.CreateResponse(newIssuer, after, ocsp.Response{
+		Status:       ocsp.Good,
+		SerialNumber: big.NewInt(42),
+		ThisUpdate:   time.Now(),
+		NextUpdate:   time.Now().Add(time.Hour),
+		Certificate:  after,
+	}, afterKey)
+	if err != nil {
+		t.Fatalf("CreateResponse: %v", err)
+	}
+	if _, err := ocsp.ParseResponse(respDER, newIssuer); err != nil {
+		t.Fatalf("a client checking against the re-keyed CA rejects the response: %v", err)
+	}
+
+	again, _, err := mgr.ensure(ctx)
+	if err != nil {
+		t.Fatalf("ensure after re-mint: %v", err)
+	}
+	if again.SerialNumber.Cmp(after.SerialNumber) != 0 {
+		t.Error("ensure re-minted the responder again after it was renewed under the new key")
+	}
+}
+
 func TestOCSPResponderEnsureRenewsWithinWindow(t *testing.T) {
 	f, mgr, ctx := newOCSPResponderFixture(t, 7*24*time.Hour)