Backport of #17138: Populate CRL data on backend startup (#17150)

* Load existing CRLs on startup and after invalidate (#17138)

* Load existing CRLs on startup and after invalidate

* changelog

* Populate during renew calls also (#17143)

* Remove unused config fetch

builtin/credential/cert/backend.go

@@ -14,6 +14,9 @@ func Factory(ctx context.Context, conf *logical.BackendConfig) (logical.Backend,
 	if err := b.Setup(ctx, conf); err != nil {
 		return nil, err
 	}
+	if err := b.populateCRLs(ctx, conf.StorageView); err != nil {
+		return nil, err
+	}
 	return b, nil
 }
 

builtin/credential/cert/path_login.go

@@ -59,6 +59,12 @@ func (b *backend) pathLoginAliasLookahead(ctx context.Context, req *logical.Requ
 }
 
 func (b *backend) pathLogin(ctx context.Context, req *logical.Request, data *framework.FieldData) (*logical.Response, error) {
+	if b.crls == nil {
+		if err := b.populateCRLs(ctx, req.Storage); err != nil {
+			return nil, err
+		}
+	}
+
 	var matched *ParsedCert
 	if verifyResp, resp, err := b.verifyCredentials(ctx, req, data); err != nil {
 		return nil, err
@@ -119,6 +125,12 @@ func (b *backend) pathLoginRenew(ctx context.Context, req *logical.Request, d *f
 		return nil, err
 	}
 
+	if b.crls == nil {
+		if err := b.populateCRLs(ctx, req.Storage); err != nil {
+			return nil, err
+		}
+	}
+
 	if !config.DisableBinding {
 		var matched *ParsedCert
 		if verifyResp, resp, err := b.verifyCredentials(ctx, req, d); err != nil {

changelog/17138.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+auth/cert: Vault does not initially load the CRLs in cert auth unless the read/write CRL endpoint is hit.
+```