tokenserver/api/admin/v1/certificate_authorities.proto

// Copyright 2016 The LUCI Authors. All rights reserved.
// Use of this source code is governed under the Apache License, Version 2.0
// that can be found in the LICENSE file.

syntax = "proto3";

package tokenserver.admin;

import "google/protobuf/empty.proto";
import "google/protobuf/timestamp.proto";

import "github.com/luci/luci-go/tokenserver/api/admin/v1/config.proto";

// CertificateAuthorities can be used by service administrators to manage and
// inspect CAs used by The Token Server.
//
// It is callable by the token service itself and by the admins.
service CertificateAuthorities {
  // FetchCRL makes the server fetch a CRL for some CA.
  rpc FetchCRL(FetchCRLRequest) returns (FetchCRLResponse);

  // ListCAs returns a list of Common Names of registered CAs.
  rpc ListCAs(google.protobuf.Empty) returns (ListCAsResponse);

  // GetCAStatus returns configuration of some CA defined in the config.
  rpc GetCAStatus(GetCAStatusRequest) returns (GetCAStatusResponse);

  // IsRevokedCert says whether a certificate serial number is in the CRL.
  rpc IsRevokedCert(IsRevokedCertRequest) returns (IsRevokedCertResponse);

  // CheckCertificate says whether a certificate is valid or not.
  rpc CheckCertificate(CheckCertificateRequest) returns (CheckCertificateResponse);
}

// FetchCRLRequest identifies a name of CA to fetch CRL for.
message FetchCRLRequest {
  string cn = 1;  // Common Name of the CA
  bool force = 2; // fetch and parse CRL even if we have it already
}

// FetchCRLResponse is returned by FetchCRL.
message FetchCRLResponse {
  CRLStatus crl_status = 1; // status of the CRL after the fetch
}

// ListCAsResponse is returned by ListCAs.
message ListCAsResponse {
  repeated string cn = 1; // Common Name of the CA
}

// GetCAStatusRequest identifies a name of CA to fetch.
message GetCAStatusRequest {
  string cn = 1; // Common Name of the CA
}

// GetCAStatusResponse is returned by GetCAStatus method.
//
// If requested CA doesn't exist, all fields are empty.
message GetCAStatusResponse {
  CertificateAuthorityConfig config = 1; // current config
  string cert = 2;          // pem-encoded CA certificate
  bool removed = 3;         // true if this CA was removed from the config
  bool ready = 4;           // true if this CA is ready for usage
  string added_rev = 5;     // config rev when this CA appeared
  string updated_rev = 6;   // config rev when this CA was updated
  string removed_rev = 7;   // config rev when this CA was removed
  CRLStatus crl_status = 8; // last known status of the CRL for this CA
}

// IsRevokedCertRequest contains a name of the CA and a cert serial number.
message IsRevokedCertRequest {
  string ca = 1; // Common Name of the CA
  string sn = 2; // cert's serial number (big.Int encoded as a decimal string)
}

// IsRevokedCertResponse is returned by IsRevokedCert
message IsRevokedCertResponse {
  bool revoked = 1; // true if the cert with given SN is in CRL
}

// CheckCertificateRequest contains a pem encoded certificate to check.
message CheckCertificateRequest {
  string cert_pem = 1; // pem encoded certificate to check for validity
}

// CheckCertificateResponse is returned by CheckCertificate.
message CheckCertificateResponse {
  bool is_valid = 1;         // true when certificate is valid
  string invalid_reason = 2; // a reason for certificate invalidity if it is invalid
}

///////////////////////////////////////////////////////////////////////////////

// CRLStatus describes the latest known state of imported CRL.
message CRLStatus {
  google.protobuf.Timestamp last_update_time = 1; // time when CRL was generated by the CA
  google.protobuf.Timestamp last_fetch_time = 2;  // time when CRL was fetched
  string last_fetch_etag = 3;                     // etag of last successfully fetched CRL
  int64 revoked_certs_count = 4;                  // number of revoked certificates in the CRL
}