diff --git a/features/features.go b/features/features.go index 262ce0933cf..4c24ec48013 100644 --- a/features/features.go +++ b/features/features.go @@ -117,6 +117,13 @@ type Config struct { // to be the authoritative source of rate limiting information for // new-account callers and disables the legacy rate limiting checks. UseKvLimitsForNewAccount bool + + // OmitShortLivedRevocation causes the AIA OCSP URL and/or the CRLDP URL to be + // omitted from certificates whose validity period is less than or equal to 7 + // days. This validity period is the threshold to qualify as a "Short-Lived + // Certificate" per the BRs Section 1.6.1, and therefore to not require + // revocation information per the BRs Sections 4.9.1.1 and 7.1.2.11.2. + OmitShortLivedRevocation bool } var fMu = new(sync.RWMutex) diff --git a/issuance/cert.go b/issuance/cert.go index b59ec8d8272..9a0ad0a5760 100644 --- a/issuance/cert.go +++ b/issuance/cert.go @@ -23,6 +23,7 @@ import ( "github.com/letsencrypt/boulder/cmd" "github.com/letsencrypt/boulder/config" + "github.com/letsencrypt/boulder/features" "github.com/letsencrypt/boulder/linter" "github.com/letsencrypt/boulder/precert" ) @@ -324,6 +325,12 @@ func (i *Issuer) Prepare(prof *Profile, req *IssuanceRequest) ([]byte, *issuance } template.DNSNames = req.DNSNames + // Remove revocation information if the certificate is short-lived and the + // feature flag to do so is enabled. + if features.Get().OmitShortLivedRevocation && template.NotAfter.Before(template.NotBefore.Add(24*7*time.Hour)) { + template.OCSPServer = nil + } + switch req.PublicKey.(type) { case *rsa.PublicKey: if prof.omitKeyEncipherment { diff --git a/test/config-next/ca.json b/test/config-next/ca.json index 9c5fa449f63..0e9b9165b7f 100644 --- a/test/config-next/ca.json +++ b/test/config-next/ca.json @@ -152,7 +152,9 @@ "ocspLogMaxLength": 4000, "ocspLogPeriod": "500ms", "ctLogListFile": "test/ct-test-srv/log_list.json", - "features": {} + "features": { + "OmitShortLivedRevocation": true + } }, "pa": { "challenges": {