Describe the bug
The certificate renewal endpoint accepts revoked X.509 certificates. Cert.renew() generates a new serial number while leaving revoked=True, so the CA CRL subsequently contains the new serial instead of the serial from the certificate that was revoked. The original certificate can therefore no longer be matched by the current CRL.
Steps To Reproduce
- Create a CA and a certificate through the PKI API or Django admin.
- Revoke the certificate with
POST /api/v1/controller/cert/<id>/revoke/.
- Record the revoked certificate serial from the CA CRL.
- Renew the same certificate with
POST /api/v1/controller/cert/<id>/renew/.
- Download the CA CRL again.
Expected behavior
Renewal of a revoked certificate is rejected, and its original serial remains present in the CA CRL.
Screenshots
N/A.
System Information:
- OS: Linux
- Python Version: 3.10.19
- Django Version: 5.2.15
- Browser and Browser Version: N/A
The issue reproduces from the current master implementation of CertRenewView.post(). A regression test should revoke a certificate, attempt renewal, and assert that the request is rejected and that the original revoked serial remains in the CRL.
Describe the bug
The certificate renewal endpoint accepts revoked X.509 certificates.
Cert.renew()generates a new serial number while leavingrevoked=True, so the CA CRL subsequently contains the new serial instead of the serial from the certificate that was revoked. The original certificate can therefore no longer be matched by the current CRL.Steps To Reproduce
POST /api/v1/controller/cert/<id>/revoke/.POST /api/v1/controller/cert/<id>/renew/.Expected behavior
Renewal of a revoked certificate is rejected, and its original serial remains present in the CA CRL.
Screenshots
N/A.
System Information:
The issue reproduces from the current
masterimplementation ofCertRenewView.post(). A regression test should revoke a certificate, attempt renewal, and assert that the request is rejected and that the original revoked serial remains in the CRL.