bullion 0.11.2 → 0.11.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 95ab410d446f9be5b65083d059c91636f5c4ee801b2973536387bb001623a0b2
-  data.tar.gz: 87f492721aaf01a88c746bed6e70d5709c19c7ba3192a7ae83d6c628e716a0dd
+  metadata.gz: 44ad24a873adf3bab2e535688588282797d477c7f973835094b52d00cb9c6592
+  data.tar.gz: ee339845aaaca5001f5a33f21c75448c8d59b19893191bbc91055d41b13edc66
 SHA512:
-  metadata.gz: 1ce61712fb1ee5ce6139bb6e105b242709c8f51eece706e116a4cff94f7361c3c7f9589598cc25373695f1df35f60b06866303f96872e1dc516748068fef338c
-  data.tar.gz: e69f33f2ee12e17572ad6ad2054a5123d7a1fe3f37471bd64432752b6b0df75892e1fba19004144349810cfae28bafb0ce23039d8cb53613f2ac9d66603eb8d1
+  metadata.gz: 2f663b5f7aedb812648c9065fd324ab0ab70a49b4ecb58c2b1160e12c84c93a5e340512be14812ec1e9d6790cce41344182df20e942d4ade2383ff81cf686dae
+  data.tar.gz: 7145c2c82d0e710de29bfc97dbe481464696d74a5381ac4dd55e56bd06605dc225dc6bd2a0593df459413d962c9583f5b3e6d133757b1e5ed75654af880b271f

data/.ruby-version

@@ -1 +1 @@
-3.4.4
+3.4.10

data/CHANGELOG.md

@@ -1,5 +1,43 @@
 # Changelog
 
+## [0.11.6](https://github.com/jgnagy/bullion/compare/bullion/v0.11.5...bullion/v0.11.6) (2026-10-02)
+
+
+### Bug Fixes
+
+* give each request fiber its own database connection ([c47a277](https://github.com/jgnagy/bullion/commit/c47a2779ab6b115bbb0c9af75559c17010353962))
+* give each request fiber its own database connection ([cca3b31](https://github.com/jgnagy/bullion/commit/cca3b313a6adf04ef9680698ca64f53027b58d3b))
+* return orderNotReady instead of badCSR for non-ready finalize ([2d5fc6f](https://github.com/jgnagy/bullion/commit/2d5fc6f15f98ba39253b294868674073d56e5f81))
+
+## [0.11.5](https://github.com/jgnagy/bullion/compare/bullion/v0.11.4...bullion/v0.11.5) (2026-09-21)
+
+
+### Bug Fixes
+
+* **ci:** disable gem attestations to unblock release ([d850693](https://github.com/jgnagy/bullion/commit/d850693bc3ca6c58b15471cea773f0c58df1b0b1))
+* **ci:** disable gem attestations to unblock release ([5bd3675](https://github.com/jgnagy/bullion/commit/5bd367593fc1bc4af1c71f27d2ed4bedbff2ad5c))
+
+## [0.11.4](https://github.com/jgnagy/bullion/compare/bullion/v0.11.3...bullion/v0.11.4) (2026-09-21)
+
+
+### Bug Fixes
+
+* package gem files without relying on git metadata ([ef70f0a](https://github.com/jgnagy/bullion/commit/ef70f0a42285aab8ae8bde1f8f0063e6a0ad38cb))
+* package gem files without relying on git metadata ([8515841](https://github.com/jgnagy/bullion/commit/851584156440fef014503a9b3320049554a9083e))
+
+## [0.11.3](https://github.com/jgnagy/bullion/compare/bullion/v0.11.2...bullion/v0.11.3) (2026-07-16)
+
+
+### Features
+
+* implement revokeCert endpoint (closes [#1](https://github.com/jgnagy/bullion/issues/1)) ([#107](https://github.com/jgnagy/bullion/issues/107)) ([b08c65a](https://github.com/jgnagy/bullion/commit/b08c65a7cbb62abef34d7a24fe7f89124fae4743))
+
+
+### Bug Fixes
+
+* replace undefined CERT_VALIDITY_DURATION constant with config call ([f858418](https://github.com/jgnagy/bullion/commit/f85841818f6d3511e436c010af86715433c57922))
+* replace undefined CERT_VALIDITY_DURATION constant with config call ([8dc0ed0](https://github.com/jgnagy/bullion/commit/8dc0ed0dabdca4d50f720e22ce7d6825233042bb)), closes [#101](https://github.com/jgnagy/bullion/issues/101)
+
 ## [0.11.2](https://github.com/jgnagy/bullion/compare/bullion/v0.11.1...bullion/v0.11.2) (2026-02-16)
 
 

data/README.md

@@ -4,7 +4,7 @@
 
 Bullion is an [ACMEv2](https://tools.ietf.org/html/rfc8555)-compatible Certificate Authority (just like [Let's Encrypt](https://letsencrypt.org/)). Bullion makes it easy to leverage open standards for provisioning certificates for internal sites and services. Things like [cert-manager](https://cert-manager.io/), [certbot](https://certbot.eff.org/), and many other technologies work great with Let's Encrypt for _external_ hostnames, but for private domains and servers that aren't Internet accessible, there are few easy options.
 
-Bullion installs easily (both as a ruby gem or a Docker image) and will shortly come with Kubernetes examples and even a helm chart to make installing it that much easier. For its data, Bullion works with either [SQLite3](https://sqlite.org/index.html) for very small sites (where HA and high-throughput isn't a concern) or with [MariaDB](https://mariadb.org/)/[MySQL](https://www.mysql.com/).
+Bullion installs easily (both as a ruby gem or a Docker image) and works with either [SQLite3](https://sqlite.org/index.html) for very small sites (where HA and high-throughput isn't a concern) or with [MariaDB](https://mariadb.org/)/[MySQL](https://www.mysql.com/) for production deployments.
 
 The goal of the Bullion project is to make running a scalable, internal ACMEv2 CA easy. Either make a custom root CA certificate or give Bullion a signed intermediary to use in simple, compatible PEM format and you're up and running.
 
@@ -20,9 +20,133 @@ The goal of the Bullion project is to make running a scalable, internal ACMEv2 C
 
 ## Usage
 
-### Running
+### Prerequisites
 
-TODO: Write instructions for starting Bullion
+Before running Bullion, you need a CA key pair. Bullion requires two PEM files:
+
+- **`tls.key`** — An encrypted private key (RSA, ECDSA, or EdDSA) for signing certificates. Bullion supports encrypted PEM keys using AES-128-CBC.
+- **`tls.crt`** — The corresponding public certificate. If Bullion is an intermediate CA, include the root CA's certificate in this file as well (certificate chain order: intermediate first, then root).
+
+You can generate these with OpenSSL. For example, a self-signed root CA:
+
+```bash
+# Generate an encrypted RSA private key
+openssl genrsa -aes128 -out tls.key 4096
+
+# Create a self-signed root certificate (5 years)
+openssl req -x509 -new -key tls.key -sha256 -days 1825 \
+  -out tls.crt -subj "/DC=example/DC=com/CN=Bullion Root CA"
+```
+
+For production, you'll typically want an intermediate CA signed by your organization's root CA. Provide the intermediate certificate and its private key to Bullion, and include the root CA certificate in `tls.crt` so clients receive the full chain.
+
+### Running with Docker
+
+The quickest way to run Bullion is with the official Docker image:
+
+```bash
+docker run -d \
+  --name bullion \
+  -p 9292:9292 \
+  -v /path/to/ssl:/ssl:ro \
+  -v /path/to/data:/data \
+  -e CA_DIR=/ssl \
+  -e CA_SECRET=your-key-password \
+  -e CA_DOMAINS=example.com \
+  -e DATABASE_URL=sqlite3:/data/bullion.db \
+  jgnagy/bullion:latest
+```
+
+This starts Bullion on port 9292 with:
+
+- CA key pair mounted from `/path/to/ssl` (containing `tls.key` and `tls.crt`)
+- SQLite database persisted at `/path/to/data/bullion.db`
+- Certificate signing restricted to `example.com` and its subdomains
+
+Verify it's running:
+
+```bash
+curl http://localhost:9292/ping
+# {"status":"up"}
+```
+
+For MySQL/MariaDB, use a `trilogy://` connection URL instead:
+
+```bash
+-e DATABASE_URL=trilogy://user:password@mariadb:3306/bullion
+```
+
+### Running as a Gem
+
+Install the gem:
+
+```bash
+gem install bullion
+```
+
+Bullion is a Rack application served by [Itsi](https://itsi.fyi/). After installing the gem, you'll need a `config.ru` and an `Itsi.rb` configuration file. The simplest approach is to create a working directory with your CA key pair and a minimal Rack config:
+
+```bash
+mkdir bullion-server && cd bullion-server
+
+# Place your CA key pair here
+cp /path/to/tls.key .
+cp /path/to/tls.crt
+
+# Create a minimal config.ru
+cat > config.ru <<'RUBY'
+# frozen_string_literal: true
+
+require "bullion"
+Bullion.validate_config!
+
+require "prometheus/middleware/collector"
+require "prometheus/middleware/exporter"
+
+use Rack::ShowExceptions
+use Rack::Deflater
+use Prometheus::Middleware::Collector
+use Prometheus::Middleware::Exporter
+
+mappings = {
+  "/ping" => Bullion::Services::Ping.new,
+  "/acme" => Bullion::Services::CA.new
+}
+
+run Rack::URLMap.new(mappings)
+RUBY
+
+# Initialize Itsi and run database migrations
+itsi init
+DATABASE_URL=sqlite3:./bullion.db bullion-exec rake db:migrate
+
+# Start the server
+CA_DIR=. CA_SECRET=your-key-password CA_DOMAINS=example.com \
+  DATABASE_URL=sqlite3:./bullion.db itsi
+```
+
+### Database Setup
+
+Bullion uses ActiveRecord migrations to create its schema. The migrations are included with the gem. Run them before starting the server:
+
+```bash
+DATABASE_URL=sqlite3:./bullion.db bundle exec rake db:migrate
+```
+
+When using Docker, the included entrypoint handles this automatically on first start. If you're running the gem directly, you may need to run migrations manually after installing the gem.
+
+### Quick Local Demo
+
+For testing or evaluation, the Rakefile includes a `local_demo` task that generates a temporary CA key pair, runs migrations, and starts the server in the foreground:
+
+```bash
+git clone https://github.com/jgnagy/bullion.git
+cd bullion
+bundle install
+bundle exec rake local_demo
+```
+
+This creates a self-signed root CA and intermediate certificate in `tmp/`, uses an SQLite database in `tmp/db/`, and starts Bullion on port 9292. Press `Ctrl+C` to stop.
 
 ### Configuration Options
 
@@ -36,7 +160,7 @@ Whether run locally or via Docker, the following environment variables configure
 | `CA_CERT_PATH` | `$CA_DIR/tls.crt` | Public cert for Bullion. If Bullion is an intermediate CA, you'll want to include the root CA's public cert in this file as well the signed cert for Bullion. |
 | `CA_DOMAINS` | `example.com` | A comma-delimited list of domains for which Bullion will sign certificate requests. Subdomains are automatically allowed. Certificates containing other domains will be rejected. |
 | `CERT_VALIDITY_DURATION` | `7776000` | How long should issued certs be valid (in seconds)? Default is 90 days. |
-| `DATABASE_URL` | _None_ | **(Required)** A shorthand for telling Bullion how to connect to a database. Acceptable URLs will either begin with `sqlite3:` or [`trilogy://`](https://github.com/trilogy-libraries/trilogy/tree/main/contrib/ruby). |
+| `DATABASE_URL` | _None_ | **(Required)** A shorthand for telling Bullion how to connect to a database. Acceptable URLs will either begin with `sqlite3:` or [`trilogy://`](https://github.com/trilogy-libraries/trilogy/tree/main/contrib/ruby). ActiveRecord connection options may be passed as query parameters, e.g. `trilogy://user:pass@host:3306/bullion?max_connections=25&checkout_timeout=5`. |
 | `DNS01_NAMESERVERS` | _None_ | A comma-delimited list of nameservers to use for resolving [DNS-01](https://letsencrypt.org/docs/challenge-types/#dns-01-challenge) challenges. Usually you'll want this to be set to your _internal_ nameservers so internal names resolve correctly. When not set, it'll use the host's DNS. |
 | `LOG_LEVEL` | `warn` | Log level for Bullion. Supported levels (starting with the noisiest) are debug, info, warn, error, and fatal. |
 | `BULLION_PORT` | `9292` | TCP port Bullion will listen on. |
@@ -45,6 +169,8 @@ Whether run locally or via Docker, the following environment variables configure
 | `WORKER_MEMORY_LIMIT` | `1024**3` | [Itsi worker memory limit](https://itsi.fyi/options/worker_memory_limit/) for each worker process (in bytes). Default is 1GiB. |
 | `RACK_ENV` | `production`* | When run via Docker, the default is `production`, when run via `rake local_demo` it is `development`. Used to tell Bullion if it is run in development mode or for testing. |
 
+Because Bullion serves requests through Itsi's [fiber scheduler](https://itsi.fyi/options/fiber_scheduler/), each in-flight request leases its own database connection. ActiveRecord's connection pool defaults to 5 connections, so raise `max_connections` on `DATABASE_URL` if you expect more concurrent requests. `checkout_timeout` (default 5 seconds) controls how long a request waits for a connection before failing.
+
 ### Integrating
 
 Any client that speaks the [ACMEv2](https://tools.ietf.org/html/rfc8555) protocol can be pointed at `/acme/directory` and everything else can be auto-discovered.
@@ -57,20 +183,10 @@ Bullion provides a `/ping` endpoint that should respond with `{ 'status': 'up' }
 
 Prometheus metrics are also scrapable at `/metrics`. This includes typical web request information as well as latencies related to the different Challenge types.
 
-## Development
+## Development & Contributing
 
-After checking out the repo, run `bin/setup` to install dependencies. Then, run `rake spec` to run the tests. You can also run `bin/console` for an interactive prompt that will allow you to experiment.
-
-To install this gem onto your local machine, run `bundle exec rake install`.
-
-## Contributing
-
-Bug reports and pull requests are welcome on GitHub at https://github.com/jgnagy/bullion. This project is intended to be a safe, welcoming space for collaboration, and contributors are expected to adhere to the [Contributor Covenant](http://contributor-covenant.org) code of conduct.
+See [`CONTRIBUTING.md`](CONTRIBUTING.md) for development setup, testing, style guidelines, and pull request expectations. Guidelines for AI agents and automated tools are in [`AGENTS.md`](AGENTS.md).
 
 ## License
 
 The gem is available as open source under the terms of the [MIT License](https://opensource.org/licenses/MIT).
-
-## Code of Conduct
-
-Everyone interacting in the Bullion project’s codebases, issue trackers, chat rooms and mailing lists is expected to follow the [code of conduct](https://github.com/jgnagy/bullion/blob/master/CODE_OF_CONDUCT.md).

data/db/migrate/20260716000000_add_revocation_to_certificates.rb

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+# Adds revocation tracking columns to the certificates table
+class AddRevocationToCertificates < ActiveRecord::Migration[8.0]
+  def change
+    add_column :certificates, :revoked, :boolean, default: false, null: false
+    add_column :certificates, :revoked_at, :datetime
+    add_column :certificates, :revocation_reason, :integer
+  end
+end

data/db/schema.rb

@@ -10,24 +10,24 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema[8.0].define(version: 2025_08_23_073342) do
+ActiveRecord::Schema[8.1].define(version: 2026_07_16_000000) do
   create_table "accounts", force: :cascade do |t|
-    t.boolean "tos_agreed", default: true, null: false
-    t.text "public_key", null: false
     t.text "contacts", null: false
     t.datetime "created_at", null: false
-    t.datetime "updated_at", null: false
+    t.text "public_key", null: false
     t.string "public_key_hash", limit: 44, null: false
+    t.boolean "tos_agreed", default: true, null: false
+    t.datetime "updated_at", null: false
     t.index ["public_key_hash"], name: "index_accounts_on_public_key_hash", unique: true
     t.index ["tos_agreed"], name: "index_accounts_on_tos_agreed"
   end
 
   create_table "authorizations", force: :cascade do |t|
-    t.string "status", default: "pending", null: false
+    t.datetime "created_at", null: false
     t.datetime "expires", null: false
     t.text "identifier", null: false
     t.bigint "order_id"
-    t.datetime "created_at", null: false
+    t.string "status", default: "pending", null: false
     t.datetime "updated_at", null: false
     t.index ["expires"], name: "index_authorizations_on_expires"
     t.index ["order_id"], name: "index_authorizations_on_order_id"
@@ -35,15 +35,18 @@ ActiveRecord::Schema[8.0].define(version: 2025_08_23_073342) do
   end
 
   create_table "certificates", force: :cascade do |t|
-    t.string "subject", null: false
+    t.text "alternate_names"
+    t.datetime "created_at", null: false
     t.string "csr_fingerprint", null: false
     t.text "data", null: false
-    t.text "alternate_names"
     t.string "requester"
-    t.boolean "validated", default: false, null: false
+    t.integer "revocation_reason"
+    t.boolean "revoked", default: false, null: false
+    t.datetime "revoked_at"
     t.bigint "serial", null: false
-    t.datetime "created_at", null: false
+    t.string "subject", null: false
     t.datetime "updated_at", null: false
+    t.boolean "validated", default: false, null: false
     t.index ["csr_fingerprint"], name: "index_certificates_on_csr_fingerprint"
     t.index ["serial"], name: "index_certificates_on_serial", unique: true
     t.index ["subject"], name: "index_certificates_on_subject"
@@ -52,13 +55,13 @@ ActiveRecord::Schema[8.0].define(version: 2025_08_23_073342) do
 
   create_table "challenges", force: :cascade do |t|
     t.string "acme_type", null: false
-    t.string "status", default: "pending", null: false
-    t.datetime "expires", null: false
-    t.string "token", null: false
-    t.datetime "validated"
     t.bigint "authorization_id"
     t.datetime "created_at", null: false
+    t.datetime "expires", null: false
+    t.string "status", default: "pending", null: false
+    t.string "token", null: false
     t.datetime "updated_at", null: false
+    t.datetime "validated"
     t.index ["acme_type"], name: "index_challenges_on_acme_type"
     t.index ["authorization_id"], name: "index_challenges_on_authorization_id"
     t.index ["expires"], name: "index_challenges_on_expires"
@@ -66,21 +69,21 @@ ActiveRecord::Schema[8.0].define(version: 2025_08_23_073342) do
   end
 
   create_table "nonces", force: :cascade do |t|
-    t.string "token", null: false
     t.datetime "created_at", null: false
+    t.string "token", null: false
     t.datetime "updated_at", null: false
     t.index ["token"], name: "index_nonces_on_token", unique: true
   end
 
   create_table "orders", force: :cascade do |t|
-    t.string "status", default: "pending", null: false
+    t.bigint "account_id"
+    t.bigint "certificate_id"
+    t.datetime "created_at", null: false
     t.datetime "expires", null: false
     t.text "identifiers", null: false
-    t.datetime "not_before", null: false
     t.datetime "not_after", null: false
-    t.bigint "certificate_id"
-    t.bigint "account_id"
-    t.datetime "created_at", null: false
+    t.datetime "not_before", null: false
+    t.string "status", default: "pending", null: false
     t.datetime "updated_at", null: false
     t.index ["account_id"], name: "index_orders_on_account_id"
     t.index ["certificate_id"], name: "index_orders_on_certificate_id"

data/lib/bullion/acme/error.rb

@@ -39,6 +39,16 @@ module Bullion
         def acme_type = "badPublicKey"
       end
 
+      # ACME exception for bad certificates
+      class BadCertificate < Bullion::Acme::Error
+        def acme_type = "badCertificate"
+      end
+
+      # ACME exception for already-revoked certificates
+      class AlreadyRevoked < Bullion::Acme::Error
+        def acme_type = "alreadyRevoked"
+      end
+
       # ACME exception for invalid contacts in accounts
       class InvalidContact < Bullion::Acme::Error
         def acme_type = "invalidContact"
@@ -54,6 +64,11 @@ module Bullion
         def acme_type = "malformed"
       end
 
+      # ACME exception for orders that aren't ready to be finalized
+      class OrderNotReady < Bullion::Acme::Error
+        def acme_type = "orderNotReady"
+      end
+
       # ACME exception for unsupported contacts in accounts
       class UnsupportedContact < Bullion::Acme::Error
         def acme_type = "unsupportedContact"

data/lib/bullion/helpers/acme.rb

@@ -125,7 +125,6 @@ module Bullion
         # Make sure the CSR has a valid public key
         raise Bullion::Acme::Errors::BadCsr unless csr.verify(csr.public_key)
 
-        return false unless order.ready_status?
         raise Bullion::Acme::Errors::BadCsr if csr_cn && !csr_domains.include?(csr_cn)
         raise Bullion::Acme::Errors::BadCsr unless csr_domains.sort == order.domains.sort
 
@@ -174,7 +173,7 @@ module Bullion
         # don't allow nonsense certs
         raise Bullion::Acme::Errors::InvalidOrder unless nb < na
         # don't allow far-future certs
-        if nb > Time.now + (7 * 86_400) || na > Time.now + CERT_VALIDITY_DURATION
+        if nb > Time.now + (7 * 86_400) || na > Time.now + Bullion.config.ca.cert_validity_duration
           raise Bullion::Acme::Errors::InvalidOrder
         end
 
@@ -192,6 +191,24 @@ module Bullion
           Bullion.config.ca.domains.none? { domain["value"].end_with?(it) }
         end
       end
+
+      # Builds the ACMEv2 order resource representation
+      # @see https://tools.ietf.org/html/rfc8555#section-7.1.3
+      def order_data(order)
+        data = {
+          status: order.status,
+          expires: order.expires,
+          notBefore: order.not_before,
+          notAfter: order.not_after,
+          identifiers: order.identifiers,
+          authorizations: order.authorizations.map { uri("/authorizations/#{it.id}") },
+          finalize: uri("/orders/#{order.id}/finalize")
+        }
+
+        data[:certificate] = uri("/certificates/#{order.certificate.id}") if order.valid_status?
+
+        data
+      end
     end
   end
 end

data/lib/bullion/models/certificate.rb

@@ -24,6 +24,11 @@ module Bullion
         subject.split("/").grep(/^CN=/).first.split("=").last
       end
 
+      # Returns true if the certificate has been revoked
+      def revoked?
+        revoked == true
+      end
+
       def self.from_csr(csr)
         subjt = csr.subject if csr.subject && !csr.subject.to_s.empty?
 

data/lib/bullion/service.rb

@@ -8,6 +8,7 @@ module Bullion
 
     configure do
       set :protection, except: :http_origin
+      set :host_authorization, permitted_hosts: []
       set :logging, true
       set :logger, Bullion::LOGGER
       set :database, Bullion.config.db_url

data/lib/bullion/services/ca.rb

@@ -66,6 +66,10 @@ module Bullion
         halt 200
       end
 
+      options "/revokecert" do
+        halt 200
+      end
+
       # Non-standard endpoint that returns the CA bundle for Bullion
       # Trusting this bundle should be sufficient to trust all Bullion-issued certs
       options "/cabundle" do
@@ -210,15 +214,7 @@ module Bullion
         content_type "application/json"
         add_acme_headers @new_nonce, additional: { "Location" => uri("/orders/#{order.id}") }
 
-        halt 201, {
-          status: order.status,
-          expires: order.expires,
-          notBefore: order.not_before,
-          notAfter: order.not_after,
-          identifiers: order.identifiers,
-          authorizations: order.authorizations.map { uri("/authorizations/#{it.id}") },
-          finalize: uri("/orders/#{order.id}/finalize")
-        }.to_json
+        halt 201, order_data(order).to_json
       rescue Bullion::Acme::Error => e
         content_type "application/problem+json"
         halt 400, { type: e.acme_error, detail: e.message }.to_json
@@ -233,19 +229,7 @@ module Bullion
 
         order = Models::Order.find(params[:id])
 
-        data = {
-          status: order.status,
-          expires: order.expires,
-          notBefore: order.not_before,
-          notAfter: order.not_after,
-          identifiers: order.identifiers,
-          authorizations: order.authorizations.map { uri("/authorizations/#{it.id}") },
-          finalize: uri("/orders/#{order.id}/finalize")
-        }
-
-        data[:certificate] = uri("/certificates/#{order.certificate.id}") if order.valid_status?
-
-        data.to_json
+        order_data(order).to_json
       rescue Bullion::Acme::Error => e
         content_type "application/problem+json"
         halt 400, { type: e.acme_error, detail: e.message }.to_json
@@ -263,6 +247,17 @@ module Bullion
 
         order_csr = Models::OrderCsr.from_acme_request(order, @payload_data["csr"])
 
+        unless order.ready_status?
+          # Finalize is idempotent for orders that have already been finalized
+          halt 200, order_data(order).to_json if %w[processing valid].include?(order.status)
+
+          content_type "application/problem+json"
+          halt 403, {
+            type: Bullion::Acme::Errors::OrderNotReady.new.acme_error,
+            detail: "Order is not ready to be finalized"
+          }.to_json
+        end
+
         unless acme_csr_valid?(order_csr)
           content_type "application/problem+json"
           halt 400, {
@@ -277,19 +272,7 @@ module Bullion
         order.status = "valid"
         order.save
 
-        data = {
-          status: order.status,
-          expires: order.expires,
-          notBefore: order.not_before,
-          notAfter: order.not_after,
-          identifiers: order.identifiers,
-          authorizations: order.authorizations.map { uri("/authorizations/#{it.id}") },
-          finalize: uri("/orders/#{order.id}/finalize")
-        }
-
-        data[:certificate] = uri("/certificates/#{order.certificate.id}") if order.valid_status?
-
-        data.to_json
+        order_data(order).to_json
       rescue Bullion::Acme::Error => e
         content_type "application/problem+json"
         halt 422, { type: e.acme_error, detail: e.message }.to_json
@@ -384,6 +367,44 @@ module Bullion
           halt(422, { error: "Order not valid" }.to_json)
         end
       end
+
+      # Revokes a certificate
+      # @see https://tools.ietf.org/html/rfc8555#section-7.6
+      post "/revokecert" do
+        parse_acme_jwt
+        add_acme_headers @new_nonce
+
+        # The certificate is base64url-encoded DER
+        cert_der = Base64.urlsafe_decode64(@payload_data["certificate"])
+        cert = OpenSSL::X509::Certificate.new(cert_der)
+
+        # Find the certificate in the database by matching the PEM data
+        record = Models::Certificate.find_by(serial: cert.serial.to_i)
+
+        unless record
+          content_type "application/problem+json"
+          halt 400, {
+            type: Bullion::Acme::Errors::BadCertificate.new.acme_error,
+            detail: "Certificate not found"
+          }.to_json
+        end
+
+        if record.revoked?
+          content_type "application/problem+json"
+          halt 400, {
+            type: Bullion::Acme::Errors::AlreadyRevoked.new.acme_error,
+            detail: "Certificate has already been revoked"
+          }.to_json
+        end
+
+        reason = @payload_data["reason"]
+        record.update!(revoked: true, revoked_at: Time.now, revocation_reason: reason)
+
+        halt 200
+      rescue Bullion::Acme::Error => e
+        content_type "application/problem+json"
+        halt 400, { type: e.acme_error, detail: e.message }.to_json
+      end
     end
   end
 end

data/lib/bullion/services/ping.rb

@@ -5,6 +5,7 @@ module Bullion
     # Healthcheck service
     class Ping < Sinatra::Application
       configure do
+        set :host_authorization, permitted_hosts: []
         set :logging, true
         set :logger, Bullion::LOGGER
       end

data/lib/bullion/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Bullion
-  VERSION = "0.11.2"
+  VERSION = "0.11.6"
 end

data/lib/bullion.rb

@@ -107,11 +107,11 @@ module Bullion
       raise ConfigError,
             "Invalid Cert Path: #{config.ca.cert_path}"
     end
-    if 60 * 60 * 24 * 397 < config.ca.cert_validity_duration
+    if config.ca.cert_validity_duration > 60 * 60 * 24 * 397
       raise ConfigError,
             "Cert Validity Too Long"
     end
-    if 60 * 60 * 24 * 2 > config.ca.cert_validity_duration
+    if config.ca.cert_validity_duration < 60 * 60 * 24 * 2
       raise ConfigError,
             "Cert Validity Too Short"
     end
@@ -140,6 +140,19 @@ Bullion.configure do |config|
   config.nameservers = nameservers if nameservers
 end
 
+# Itsi processes each request inside its own Fiber, but all fibers on a thread
+# share an ActiveSupport execution context by default. ActiveRecord leases a
+# database connection per execution context, so without fiber isolation every
+# concurrent request fiber on a thread shares (and races on) the same
+# connection. Trilogy detects this and raises Trilogy::SynchronizationError.
+# Mirror Itsi's own scheduler_mode hook (which itsi-server 0.2.27 never loads)
+# and the Rails 8.1+ default by opting into fiber isolation, honoring Itsi's
+# opt-out.
+# @see https://github.com/jgnagy/bullion/issues/116
+unless ENV["ITSI_DISABLE_AS_AUTO_FIBER_ISOLATION_LEVEL"]
+  ActiveSupport::IsolatedExecutionState.isolation_level = :fiber
+end
+
 # Internal requirements
 require "bullion/version"
 require "bullion/acme/error"