#535 Make the revocation of child certificates optional (#544)

* #535 Make the revocation of child certificates optional

- Add `revoke-child` flag
- Cover unit and integration tests

Signed-off-by: Abdulbois <abdulbois.tursunov@dsr-corporation.com>
Signed-off-by: Abdulbois <abdulbois123@gmail.com>

docs/static/openapi.yml

@@ -9826,6 +9826,8 @@ paths:
                       type: string
                     serialNumber:
                       type: string
+                    revokeChild:
+                      type: boolean
               pagination:
                 type: object
                 properties:
@@ -9967,6 +9969,8 @@ paths:
                     type: string
                   serialNumber:
                     type: string
+                  revokeChild:
+                    type: boolean
         default:
           description: An unexpected error response.
           schema:
@@ -21135,6 +21139,8 @@ definitions:
         type: string
       serialNumber:
         type: string
+      revokeChild:
+        type: boolean
   zigbeealliance.distributedcomplianceledger.pki.QueryAllApprovedCertificatesResponse:
     type: object
     properties:
@@ -21480,6 +21486,8 @@ definitions:
               type: string
             serialNumber:
               type: string
+            revokeChild:
+              type: boolean
       pagination:
         type: object
         properties:
@@ -22012,6 +22020,8 @@ definitions:
             type: string
           serialNumber:
             type: string
+          revokeChild:
+            type: boolean
   zigbeealliance.distributedcomplianceledger.pki.QueryGetRejectedCertificatesResponse:
     type: object
     properties:

docs/transactions.md

@@ -936,7 +936,7 @@ Revokes the given X509 certificate (either intermediate or leaf).
 Revocation here just means removing it from the ledger.
 If a Revocation Distribution Point needs to be published (such as RFC5280 Certificate Revocation List), please use [ADD_PKI_REVOCATION_DISTRIBUTION_POINT](#add_pki_revocation_distribution_point).
 
-All the certificates in the chain signed by the revoked certificate will be revoked as well.
+If `revoke-child` flag is set to `true` then all the certificates in the chain signed by the revoked certificate will be revoked as well.
 
 Only the owner (sender) can revoke the certificate.
 Root certificates can not be revoked this way, use  `PROPOSE_X509_CERT_REVOC` and `APPROVE_X509_ROOT_CERT_REVOC` instead.  
@@ -945,6 +945,7 @@ Root certificates can not be revoked this way, use  `PROPOSE_X509_CERT_REVOC` an
   - subject: `string`  - certificates's `Subject` is base64 encoded subject DER sequence bytes
   - subject_key_id: `string`  - certificates's `Subject Key Id` in hex string format, e.g: `5A:88:0E:6C:36:53:D0:7F:B0:89:71:A3:F4:73:79:09:30:E6:2B:DB`
   - serial-number: `optional(string)`  - certificate's serial number
+  - revoke-child: `optional(bool)`  - to revoke child certificates in the chain - default is false
   - info: `optional(string)` - information/notes for the revocation
   - time: `optional(int64)` - revocation time (number of nanoseconds elapsed since January 1, 1970 UTC). CLI uses the current time for that field.
 - In State: `pki/RevokedCertificates/value/<Certificate's Subject>/<Certificate's Subject Key ID>`
@@ -980,7 +981,7 @@ Proposes revocation of the given X509 root certificate by a Trustee.
 Revocation here just means removing it from the ledger.
 If a Revocation Distribution Point needs to be published (such as RFC5280 Certificate Revocation List), please use [ADD_PKI_REVOCATION_DISTRIBUTION_POINT](#add_pki_revocation_distribution_point).
 
-All the certificates in the chain signed by the revoked certificate will be revoked as well.
+If `revoke-child` flag is set to `true` then all the certificates in the chain signed by the revoked certificate will be revoked as well.
 
 If more than 1 Trustee signature is required to revoke a root certificate,
 then the certificate will be in a pending state until sufficient number of other Trustee's approvals is received.
@@ -989,6 +990,7 @@ then the certificate will be in a pending state until sufficient number of other
   - subject: `string`  - certificates's `Subject` is base64 encoded subject DER sequence bytes
   - subject_key_id: `string`  - certificates's `Subject Key Id` in hex string format, e.g: `5A:88:0E:6C:36:53:D0:7F:B0:89:71:A3:F4:73:79:09:30:E6:2B:DB`
   - serial-number: `optional(string)`  - certificate's serial number
+  - revoke-child: `optional(bool)`  - to revoke child certificates in the chain - default is false
   - info: `optional(string)` - information/notes for the revocation proposal
   - time: `optional(int64)` - revocation proposal time (number of nanoseconds elapsed since January 1, 1970 UTC). CLI uses the current time for that field.
 - In State: `pki/ProposedCertificateRevocation/value/<Certificate's Subject>/<Certificate's Subject Key ID>`

integration_tests/cli/pki-demo.sh

@@ -650,7 +650,7 @@ test_divider
 echo "6. REVOKE INTERMEDIATE (AND HENCE  LEAF) CERTS - No Approvals needed"
 test_divider
 
-echo "$user_account (Not Trustee) revokes Intermediate certificate. This must also revoke its child - Leaf certificate."
+echo "$user_account (Not Trustee) revokes only Intermediate certificate. This must not revoke its child - Leaf certificate."
 result=$(echo "$passphrase" | dcld tx pki revoke-x509-cert --subject="$intermediate_cert_subject" --subject-key-id="$intermediate_cert_subject_key_id" --from=$user_account --yes)
 check_response "$result" "\"code\": 0"
 
@@ -680,8 +680,8 @@ result=$(dcld query pki all-revoked-x509-certs)
 echo $result | jq
 check_response "$result" "\"subject\": \"$intermediate_cert_subject\""
 check_response "$result" "\"subjectKeyId\": \"$intermediate_cert_subject_key_id\""
-check_response "$result" "\"subject\": \"$leaf_cert_subject\""
-check_response "$result" "\"subjectKeyId\": \"$leaf_cert_subject_key_id\""
+response_does_not_contain "$result" "\"subject\": \"$leaf_cert_subject\""
+response_does_not_contain "$result" "\"subjectKeyId\": \"$leaf_cert_subject_key_id\""
 response_does_not_contain "$result" "\"subject\": \"$root_cert_subject\""
 response_does_not_contain "$result" "\"subjectKeyId\": \"$root_cert_subject_key_id\""
 
@@ -711,21 +711,21 @@ test_divider
 echo "Request revoked Leaf certificate"
 result=$(dcld query pki revoked-x509-cert --subject="$leaf_cert_subject" --subject-key-id="$leaf_cert_subject_key_id")
 echo $result | jq
-check_response "$result" "\"subject\": \"$leaf_cert_subject\""
-check_response "$result" "\"subjectKeyId\": \"$leaf_cert_subject_key_id\""
-check_response "$result" "\"serialNumber\": \"$leaf_cert_serial_number\""
+response_does_not_contain "$result" "\"subject\": \"$leaf_cert_subject\""
+response_does_not_contain "$result" "\"subjectKeyId\": \"$leaf_cert_subject_key_id\""
+response_does_not_contain "$result" "\"serialNumber\": \"$leaf_cert_serial_number\""
 
 test_divider
 
 echo "Request all approved certificates"
 result=$(dcld query pki all-x509-certs)
 echo $result | jq
-check_response "$result" "\"subject\": \"$root_cert_subject\""
-check_response "$result" "\"subjectKeyId\": \"$root_cert_subject_key_id\""
 response_does_not_contain "$result" "\"subject\": \"$intermediate_cert_subject\""
 response_does_not_contain "$result" "\"subjectKeyId\": \"$intermediate_cert_subject_key_id\""
-response_does_not_contain "$result" "\"subject\": \"$leaf_cert_subject\""
-response_does_not_contain "$result" "\"subjectKeyId\": \"$leaf_cert_subject_key_id\""
+check_response "$result" "\"subject\": \"$root_cert_subject\""
+check_response "$result" "\"subjectKeyId\": \"$root_cert_subject_key_id\""
+check_response "$result" "\"subject\": \"$leaf_cert_subject\""
+check_response "$result" "\"subjectKeyId\": \"$leaf_cert_subject_key_id\""
 
 test_divider
 
@@ -744,12 +744,12 @@ test_divider
 echo "Request all subject certificates"
 result=$(dcld query pki all-subject-x509-certs --subject="$leaf_cert_subject")
 echo $result | jq
+check_response "$result" "\"$leaf_cert_subject\""
+check_response "$result" "\"$leaf_cert_subject_key_id\""
 response_does_not_contain "$result" "\"$root_cert_subject\""
 response_does_not_contain "$result" "\"$root_cert_subject_key_id\""
 response_does_not_contain "$result" "\"$intermediate_cert_subject\""
 response_does_not_contain "$result" "\"$intermediate_cert_subject_key_id\""
-response_does_not_contain "$result" "\"$leaf_cert_subject\""
-response_does_not_contain "$result" "\"$leaf_cert_subject_key_id\""
 
 test_divider
 
@@ -775,13 +775,12 @@ response_does_not_contain "$result" "\"serialNumber\": \"$intermediate_cert_seri
 
 test_divider
 
-echo "Approved Leaf certificate must be empty"
+echo "Approved Leaf certificate must not be empty"
 result=$(dcld query pki x509-cert --subject="$leaf_cert_subject" --subject-key-id="$leaf_cert_subject_key_id")
 echo $result | jq
-check_response "$result" "Not Found"
-response_does_not_contain "$result" "\"subject\": \"$leaf_cert_subject\""
-response_does_not_contain "$result" "\"subjectKeyId\": \"$leaf_cert_subject_key_id\""
-response_does_not_contain "$result" "\"serialNumber\": \"$leaf_cert_serial_number\""
+check_response "$result" "\"subject\": \"$leaf_cert_subject\""
+check_response "$result" "\"subjectKeyId\": \"$leaf_cert_subject_key_id\""
+check_response "$result" "\"serialNumber\": \"$leaf_cert_serial_number\""
 
 test_divider
 
@@ -790,7 +789,7 @@ test_divider
 echo "7. PROPOSE REVOCATION OF ROOT CERT"
 test_divider
 
-echo "$trustee_account (Trustee) proposes to revoke Root certificate"
+echo "$trustee_account (Trustee) proposes to revoke only Root certificate(child certificates should not be revoked)"
 result=$(echo "$passphrase" | dcld tx pki propose-revoke-x509-root-cert --subject="$root_cert_subject" --subject-key-id="$root_cert_subject_key_id" --from $trustee_account --yes)
 check_response "$result" "\"code\": 0"
 
@@ -820,8 +819,8 @@ result=$(dcld query pki all-revoked-x509-certs)
 echo $result | jq
 check_response "$result" "\"subject\": \"$intermediate_cert_subject\""
 check_response "$result" "\"subjectKeyId\": \"$intermediate_cert_subject_key_id\""
-check_response "$result" "\"subject\": \"$leaf_cert_subject\""
-check_response "$result" "\"subjectKeyId\": \"$leaf_cert_subject_key_id\""
+response_does_not_contain "$result" "\"subject\": \"$leaf_cert_subject\""
+response_does_not_contain "$result" "\"subjectKeyId\": \"$leaf_cert_subject_key_id\""
 response_does_not_contain "$result" "\"subject\": \"$root_cert_subject\""
 response_does_not_contain "$result" "\"subjectKeyId\": \"$root_cert_subject_key_id\""
 
@@ -857,10 +856,10 @@ result=$(dcld query pki all-x509-certs)
 echo $result | jq
 check_response "$result" "\"subject\": \"$root_cert_subject\""
 check_response "$result" "\"subjectKeyId\": \"$root_cert_subject_key_id\""
+check_response "$result" "\"subject\": \"$leaf_cert_subject\""
+check_response "$result" "\"subjectKeyId\": \"$leaf_cert_subject_key_id\""
 response_does_not_contain "$result" "\"subject\": \"$intermediate_cert_subject\""
 response_does_not_contain "$result" "\"subjectKeyId\": \"$intermediate_cert_subject_key_id\""
-response_does_not_contain "$result" "\"subject\": \"$leaf_cert_subject\""
-response_does_not_contain "$result" "\"subjectKeyId\": \"$leaf_cert_subject_key_id\""
 
 
 test_divider
@@ -883,10 +882,10 @@ result=$(dcld query pki all-subject-x509-certs --subject="$root_cert_subject")
 echo $result | jq
 check_response "$result" "\"$root_cert_subject\""
 check_response "$result" "\"$root_cert_subject_key_id\""
-response_does_not_contain "$result" "\"$intermediate_cert_subject\""
-response_does_not_contain "$result" "\"$intermediate_cert_subject_key_id\""
 response_does_not_contain "$result" "\"$leaf_cert_subject\""
 response_does_not_contain "$result" "\"$leaf_cert_subject_key_id\""
+response_does_not_contain "$result" "\"$intermediate_cert_subject\""
+response_does_not_contain "$result" "\"$intermediate_cert_subject_key_id\""
 
 test_divider
 
@@ -902,7 +901,7 @@ check_response "$result" "\"code\": 0"
 
 test_divider
 
-echo "Request all root certificates proposed to revoke. Nothing left in list as the certficate is revoked"
+echo "Request all root certificates proposed to revoke. Nothing left in list as the certificates are revoked"
 result=$(dcld query pki all-proposed-x509-root-certs-to-revoke)
 response_does_not_contain "$result" "\"subject\": \"$root_cert_subject\""
 response_does_not_contain "$result" "\"subjectKeyId\": \"$root_cert_subject_key_id\""
@@ -917,14 +916,14 @@ test_divider
 echo "Request all revoked certificates should contain approvals from both trustees"
 result=$(dcld query pki all-revoked-x509-certs)
 echo $result | jq
-check_response "$result" "\"subject\": \"$intermediate_cert_subject\""
-check_response "$result" "\"subjectKeyId\": \"$intermediate_cert_subject_key_id\""
-check_response "$result" "\"subject\": \"$leaf_cert_subject\""
-check_response "$result" "\"subjectKeyId\": \"$leaf_cert_subject_key_id\""
 check_response "$result" "\"subject\": \"$root_cert_subject\""
 check_response "$result" "\"subjectKeyId\": \"$root_cert_subject_key_id\""
 check_response "$result" "\"address\": \"$trustee_account_address\""
 check_response "$result" "\"address\": \"$second_trustee_account_address\""
+check_response "$result" "\"subject\": \"$intermediate_cert_subject\""
+check_response "$result" "\"subjectKeyId\": \"$intermediate_cert_subject_key_id\""
+response_does_not_contain "$result" "\"subject\": \"$leaf_cert_subject\""
+response_does_not_contain "$result" "\"subjectKeyId\": \"$leaf_cert_subject_key_id\""
 
 
 test_divider
@@ -958,15 +957,15 @@ check_response "$result" "\"address\": \"$second_trustee_account_address\""
 
 test_divider
 
-echo "Request all approved certificates must be empty"
+echo "Request all approved certificates must not contain root certificate"
 result=$(dcld query pki all-x509-certs)
 echo $result | jq
 response_does_not_contain "$result" "\"subject\": \"$root_cert_subject\""
 response_does_not_contain "$result" "\"subjectKeyId\": \"$root_cert_subject_key_id\""
 response_does_not_contain "$result" "\"subject\": \"$intermediate_cert_subject\""
 response_does_not_contain "$result" "\"subjectKeyId\": \"$intermediate_cert_subject_key_id\""
-response_does_not_contain "$result" "\"subject\": \"$leaf_cert_subject\""
-response_does_not_contain "$result" "\"subjectKeyId\": \"$leaf_cert_subject_key_id\""
+check_response "$result" "\"subject\": \"$leaf_cert_subject\""
+check_response "$result" "\"subjectKeyId\": \"$leaf_cert_subject_key_id\""
 
 
 echo "Request all approved root certificates must be empty"
@@ -985,7 +984,6 @@ test_divider
 echo "Approved Intermediate certificate must be empty"
 result=$(dcld query pki x509-cert --subject="$intermediate_cert_subject" --subject-key-id="$intermediate_cert_subject_key_id")
 echo $result | jq
-check_response "$result" "Not Found"
 response_does_not_contain "$result" "\"subject\": \"$intermediate_cert_subject\""
 response_does_not_contain "$result" "\"subjectKeyId\": \"$intermediate_cert_subject_key_id\""
 response_does_not_contain "$result" "\"serialNumber\": \"$intermediate_cert_serial_number\""
@@ -994,14 +992,13 @@ response_does_not_contain "$result" "\"subjectAsText\": \"$intermediate_cert_sub
 
 test_divider
 
-echo "Approved Leaf certificate must be empty"
+echo "Approved Leaf certificate must not be empty"
 result=$(dcld query pki x509-cert --subject="$leaf_cert_subject" --subject-key-id="$leaf_cert_subject_key_id")
 echo $result | jq
-check_response "$result" "Not Found"
-response_does_not_contain "$result" "\"subject\": \"$leaf_cert_subject\""
-response_does_not_contain "$result" "\"subjectKeyId\": \"$leaf_cert_subject_key_id\""
-response_does_not_contain "$result" "\"serialNumber\": \"$leaf_cert_serial_number\""
-response_does_not_contain "$result" "\"subjectAsText\": \"$leaf_cert_subject_as_text\""
+check_response "$result" "\"subject\": \"$leaf_cert_subject\""
+check_response "$result" "\"subjectKeyId\": \"$leaf_cert_subject_key_id\""
+check_response "$result" "\"serialNumber\": \"$leaf_cert_serial_number\""
+check_response "$result" "\"subjectAsText\": \"$leaf_cert_subject_as_text\""
 
 
 test_divider
@@ -1049,9 +1046,8 @@ response_does_not_contain "$result" "\"serialNumber\": \"$google_cert_serial_num
 response_does_not_contain "$result" "\"subjectAsText\": \"$google_cert_subject_as_text\""
 echo $result | jq
 
-echo "Request all approved certificates must be empty"
+echo "Request all approved certificates must not contain google certification"
 result=$(dcld query pki all-x509-certs)
-check_response "$result" "\[\]"
 response_does_not_contain "$result" "\"subject\": \"$google_cert_subject\""
 response_does_not_contain "$result" "\"subjectKeyId\": \"$google_cert_subject_key_id\""
 response_does_not_contain "$result" "\"serialNumber\": \"$google_cert_serial_number\""
@@ -1087,7 +1083,7 @@ response_does_not_contain "$result" "\"subject\": \"$google_cert_subject\""
 response_does_not_contain "$result" "\"subjectKeyId\": \"$google_cert_subject_key_id\""
 echo $result | jq
 
-echo "Request all revoked certificates must be empty"
+echo "Request all revoked certificates must not contain google certification"
 result=$(dcld query pki all-revoked-x509-certs)
 response_does_not_contain "$result" "\"$google_cert_subject\""
 response_does_not_contain "$result" "\"$google_cert_subject_key_id\""