@andrewheberle/serverless-ssh-ca 0.22.0 → 0.24.0

package/src/certificate.ts

@@ -1,14 +1,9 @@
 import { seconds } from "itty-time"
-import sshpk from "sshpk"
-import type { Certificate, Identity, Key, PrivateKey } from "sshpk"
-import { SSHExtension } from "./types.js"
+import type { PrivateKey, PublicKey } from "./ssh/keys.js"
 import { getPrivateKey, split } from "./utils.js"
 import type { SshCaBindings } from "./types.js"
-
-// sshpk is CommonJS and Node's ESM loader cannot detect most of its named exports, so values are taken from the default import
-const { createCertificate, identityForHost, identityForUser, identityFromDN } = sshpk
-
-// const sshCertificateExtensions = split(env.SSH_CERTIFICATE_EXTENSIONS)
+import { signCertificate, type CertificateFields, type SshCertificate } from "./ssh/certificate.js"
+import { createSigner } from "./ssh/signer.js"
 
 export type CreateCertificateOptions = {
 	lifetime?: number
@@ -16,12 +11,6 @@ export type CreateCertificateOptions = {
 	extensions?: string[]
 }
 
-/* const DefaultCreateCertificateOptions: CreateCertificateOptions = {
-	lifetime: seconds(env.SSH_CERTIFICATE_LIFETIME),
-	principals: [],
-	extensions: sshCertificateExtensions
-} */
-
 export class CertificateError extends Error {
 	constructor(message: string) {
 		super(message)
@@ -41,18 +30,36 @@ export type GenerateCertificateOptions = {
 	serial?: bigint
 } & CreateCertificateOptions
 
-export const generateCertificate = (env: SshCaBindings, email: string, key: PrivateKey, public_key: Key, options?: GenerateCertificateOptions): Certificate => {
-	let { lifetime } = options ?? {}
-	const { principals, extensions, serial } = options ?? {}
+/**
+ * Signs a certificate with the CA key
+ *
+ * @throws {@link CertificateError} when the certificate has no principals,
+ * as OpenSSH accepts a certificate without principals for any user or host
+ */
+const sign = async (key: PrivateKey, fields: Omit<CertificateFields, "validAfter" | "validBefore">, lifetime: number): Promise<SshCertificate> => {
+	if (fields.principals.length === 0) {
+		throw new CertificateError("a certificate must have at least one principal")
+	}
+
+	// the validity is to the second, so starts at the current second rather
+	// than in the future
+	const validAfter = new Date(Math.floor(Date.now() / 1000) * 1000)
+	const validBefore = new Date(validAfter.getTime() + lifetime * 1000)
 
-	// add identities
+	return await signCertificate({ ...fields, validAfter, validBefore }, await createSigner(key))
+}
+
+export const generateCertificate = async (env: SshCaBindings, email: string, key: PrivateKey, public_key: PublicKey, options?: GenerateCertificateOptions): Promise<SshCertificate> => {
+	const { lifetime, principals, extensions, serial } = options ?? {}
+
+	// add principals
 	const includeSelf = env.SSH_CERTIFICATE_INCLUDE_SELF === undefined
 		? false
 		: typeof env.SSH_CERTIFICATE_INCLUDE_SELF === "string"
 			? env.SSH_CERTIFICATE_INCLUDE_SELF === "true"
 			: env.SSH_CERTIFICATE_INCLUDE_SELF
-	const identity = includeSelf
-		? [identityForUser(email.split("@")[0]!)]
+	const certificatePrincipals = includeSelf
+		? [email.split("@")[0]!]
 		: []
 
 	// add email?
@@ -62,86 +69,43 @@ export const generateCertificate = (env: SshCaBindings, email: string, key: Priv
 			? env.SSH_CERTIFICATE_INCLUDE_SELF_EMAIL === "true"
 			: env.SSH_CERTIFICATE_INCLUDE_SELF_EMAIL
 	if (includeSelfEmail) {
-		identity.push(identityForUser(email))
+		certificatePrincipals.push(email)
 	}
 
 	if (principals !== undefined) {
-		for (const p of principals) {
-			identity.push(identityForUser(p))
-		}
-	}
-
-	for (const p of split(env.SSH_CERTIFICATE_PRINCIPALS)) {
-		identity.push(identityForUser(p))
+		certificatePrincipals.push(...principals)
 	}
 
-
-	// lifetime is the smaller of what was provided in the options or the default
-	lifetime = lifetime !== undefined
-		? Math.min(lifetime, seconds(env.SSH_CERTIFICATE_LIFETIME))
-		: seconds(env.SSH_CERTIFICATE_LIFETIME)
-
-	// generate value for serial of certificate
-	const s = generateSerial(serial)
-
-	// set issuer of certificate based on ISSUER_DN
-	const issuer = identityFromDN(env.ISSUER_DN)
-
-	// create certificate
-	const certificate = createCertificate(identity, public_key, issuer, key, { lifetime: lifetime, serial: s })
-
-	// ensure openssh info is included in certificate (should not occur)
-	if (certificate.signatures.openssh === undefined) {
-		throw new CertificateError("missing openssh information in certificate")
-	}
+	certificatePrincipals.push(...split(env.SSH_CERTIFICATE_PRINCIPALS))
 
 	const sshCertificateExtensions = split(env.SSH_CERTIFICATE_EXTENSIONS)
 
-	// add usage extensions
-	const sshextensions: SSHExtension[] = []
+	// if extensions are provided in request, ensure they do not include extra extensions beyond the defaults
 	if (extensions !== undefined) {
-		// if extensions are provided in request, ensure they do not include extra extensions beyond the defaults
 		for (const ext of extensions) {
 			if (!sshCertificateExtensions.includes(ext)) {
 				throw new CertificateError(`${ext} is not allowed`)
 			}
-
-			// add to list of allowed extensions
-			sshextensions.push({
-				critical: false,
-				name: ext,
-				data: Buffer.alloc(0)
-			})
-		}
-	} else {
-		// use defaults if not provided
-		sshCertificateExtensions.forEach((ext: string) => {
-			sshextensions.push({
-				critical: false,
-				name: ext,
-				data: Buffer.alloc(0)
-			})
-		})
-
-	}
-
-	// add info to certificate
-	certificate.signatures = {
-		openssh: {
-			nonce: certificate.signatures.openssh.nonce,
-			keyId: email,
-			signature: certificate.signatures.openssh.signature,
-			exts: sshextensions
 		}
 	}
 
-	// re-sign after changes
-	certificate.signWith(key)
+	// lifetime is the smaller of what was provided in the options or the default
+	const certificateLifetime = lifetime !== undefined
+		? Math.min(lifetime, seconds(env.SSH_CERTIFICATE_LIFETIME))
+		: seconds(env.SSH_CERTIFICATE_LIFETIME)
 
-	return certificate
+	return await sign(key, {
+		kind: "user",
+		publicKey: public_key,
+		serial: serial ?? generateSerial(),
+		keyId: email,
+		principals: certificatePrincipals,
+		// use defaults if not provided
+		extensions: extensions ?? sshCertificateExtensions,
+	}, certificateLifetime)
 }
 
-export async function createSignedCertificate(env: SshCaBindings, email: string, public_key: Key, options?: CreateCertificateOptions): Promise<Certificate> {
+export async function createSignedCertificate(env: SshCaBindings, email: string, public_key: PublicKey, options?: CreateCertificateOptions): Promise<SshCertificate> {
 	// grab private key from secret store
 	const key = await getPrivateKey(env)
 
@@ -153,13 +117,12 @@ export async function createSignedCertificate(env: SshCaBindings, email: string,
 		}
 	}
 
-	return generateCertificate(env, email, key, public_key, options)
+	return await generateCertificate(env, email, key, public_key, options)
 }
 
 export type CreateHostCertificateOptions = {
 	lifetime?: number
 	principals?: string[]
-	subjects?: Identity[]
 }
 
 export class BadIssuerError extends Error {
@@ -171,54 +134,30 @@ export class BadIssuerError extends Error {
 	}
 }
 
-export async function createSignedHostCertificate(env: SshCaBindings, public_key: Key, options?: CreateHostCertificateOptions): Promise<Certificate> {
-	if (options === undefined) {
-		options = {
-			lifetime: seconds(env.SSH_HOST_CERTIFICATE_LIFETIME),
-			principals: []
-		}
-	}
-	// generate list of identities for host key
-	const identity: Identity[] = []
-	if (options.principals !== undefined) {
-		for (const p of options.principals) {
-			identity.push(identityForHost(p))
-		}
-	}
-
-	// add any already provided subjects (for renewals only)
-	if (options.subjects !== undefined) {
-		identity.push(...options.subjects)
-	}
+export async function createSignedHostCertificate(env: SshCaBindings, public_key: PublicKey, options?: CreateHostCertificateOptions): Promise<SshCertificate> {
+	const principals = options?.principals ?? []
 
 	// grab private key from secret store
 	const key = await getPrivateKey(env)
 
 	// lifetime is the smaller of what was provided in the options or the default
-	const lifetime = options.lifetime !== undefined
+	const lifetime = options?.lifetime !== undefined
 		? Math.min(options.lifetime, seconds(env.SSH_HOST_CERTIFICATE_LIFETIME))
 		: seconds(env.SSH_HOST_CERTIFICATE_LIFETIME)
 
-	// generate value for serial of certificate
-	const serial = generateSerial()
-
-	// set issuer of certificate based on ISSUER_DN
-	const issuer = identityFromDN(env.ISSUER_DN)
-
-	// create certificate
-	const certificate = createCertificate(identity, public_key, issuer, key, { lifetime: lifetime, serial: serial })
-
-	return certificate
+	return await sign(key, {
+		kind: "host",
+		publicKey: public_key,
+		serial: generateSerial(),
+		keyId: `host_${principals[0]}`,
+		principals,
+		extensions: [],
+	}, lifetime)
 }
 
-export const generateSerial = (serial?: bigint): Buffer<ArrayBuffer> => {
-	if (serial !== undefined) {
-		const s = Buffer.alloc(8)
-		s.writeBigUInt64BE(serial)
-
-		return s
-	}
-
-	const randomBytes = crypto.getRandomValues(new Uint8Array(8))
-	return Buffer.from(randomBytes)
+/**
+ * Returns a random certificate serial number
+ */
+export const generateSerial = (): bigint => {
+	return new DataView(crypto.getRandomValues(new Uint8Array(8)).buffer).getBigUint64(0)
 }

package/src/db/index.ts

@@ -1,11 +1,12 @@
-import type { Certificate, Format, Identity } from "sshpk"
+import { PublicKey } from "../ssh/keys.js"
+import type { SshCertificate } from "../ssh/certificate.js"
 import { logger } from "../logger.js"
 import type { SshCaBindings } from "../types.js"
 import { D1QB } from "workers-qb"
 import { z } from "zod"
 import { migrateOnce } from "./migrate.js"
 import { migrations } from "./migrations/index.js"
-import { CertificateType, type CertificateRecord, type DatabaseSchema, type KrlRecord } from "./types.js"
+import { CertificateType, type DatabaseSchema, type KrlRecord } from "./types.js"
 
 const connect = async (env: SshCaBindings): Promise<D1QB<DatabaseSchema>> => {
 	const l = logger(env)
@@ -24,6 +25,14 @@ const connect = async (env: SshCaBindings): Promise<D1QB<DatabaseSchema>> => {
 	}
 }
 
+// statements that increment the KRL revision, so a KRL cached for an earlier
+// revision is not used again
+const BumpAllRevisions = "UPDATE krl SET revision = revision + 1"
+
+// increments the revision of the KRL for a certificate type, but only if the
+// previous statement in the same batch changed a row
+const BumpRevisionIfChanged = "UPDATE krl SET revision = revision + 1 WHERE certificate_type = ? AND changes() = 1"
+
 export const dbCleanup = async (env: SshCaBindings) => {
 	const l = logger(env).with("retention", env.DB_CERTIFICATE_RETENTION)
 
@@ -43,33 +52,48 @@ export const dbCleanup = async (env: SshCaBindings) => {
 			}
 		}).execute()
 		l.info("completed database cleanup", "changes", res.meta?.changes)
+
+		// revoked certificates may have been removed from the KRLs, so cached
+		// KRLs must not be used again
+		if ((res.meta?.changes ?? 0) > 0) {
+			await env.DB.prepare(BumpAllRevisions).run()
+		}
 	} catch (err) {
 		l.error("error during database cleanup", "retention", env.DB_CERTIFICATE_RETENTION, "error", err)
 	}
 }
 
-export const recordCertificate = async (env: SshCaBindings, certificate: Certificate, keyid: string, certificateType: CertificateType = CertificateType.User) => {
-	const serial = certificate.serial.readBigUInt64BE(0)
-	const subjects = certificate.subjects.map((v: Identity): string => {
-		return v.toString()
-	}).join(",")
-	const extensions = certificate.getExtensions().map((v: Format.OpenSshSignatureExt | Format.x509SignatureExt): string => {
-		// @ts-expect-error: the name property does exist
-		return v.name as string
-	}).join(",")
+// the columns recorded for an issued certificate, in the order of the values
+// returned by certificateValues
+const CertificateColumns = ["serial", "key_id", "principals", "extensions", "valid_after", "valid_before", "certificate_type", "public_key"] as const
+
+const certificateRecord = (certificate: SshCertificate, keyid: string, certificateType: CertificateType) => {
+	// principals are recorded as distinguished names, as they were when
+	// certificates were created with sshpk
+	const principals = certificate.principals.map((p) => `${certificate.kind === "host" ? "CN" : "UID"}=${p}`).join(",")
+
+	return {
+		serial: `${certificate.serial}`,
+		key_id: keyid,
+		principals: principals,
+		extensions: certificate.extensions.join(","),
+		valid_after: certificate.validAfter.toISOString(),
+		valid_before: certificate.validBefore.toISOString(),
+		certificate_type: certificateType,
+		public_key: certificate.publicKey.toString()
+	}
+}
+
+const certificateValues = (certificate: SshCertificate, keyid: string, certificateType: CertificateType): (string | number)[] => {
+	const record = certificateRecord(certificate, keyid, certificateType)
+	return CertificateColumns.map((column) => record[column])
+}
+
+export const recordCertificate = async (env: SshCaBindings, certificate: SshCertificate, keyid: string, certificateType: CertificateType = CertificateType.User) => {
 	const qb = await connect(env)
 	const res = await qb.insert({
 		tableName: "certificates",
-		data: {
-			serial: `${serial}`,
-			key_id: keyid,
-			principals: subjects,
-			extensions: extensions,
-			valid_after: certificate.validFrom.toISOString(),
-			valid_before: certificate.validUntil.toISOString(),
-			certificate_type: certificateType,
-			public_key: certificate.subjectKey.toString("ssh")
-		},
+		data: certificateRecord(certificate, keyid, certificateType),
 	}).execute()
 
 	if (!res.success) {
@@ -77,6 +101,49 @@ export const recordCertificate = async (env: SshCaBindings, certificate: Certifi
 	}
 }
 
+/**
+ * Records a host certificate issued by renewing another, revoking the
+ * certificate that was renewed so it cannot be used or renewed again.
+ *
+ * This is done in a single transaction, and the renewed certificate is only
+ * recorded if this call revoked the previous certificate, so when a
+ * certificate is renewed more than once concurrently only one renewal is
+ * recorded. A previous certificate that was never recorded (for example one
+ * signed with the CA key outside of the CA) is recorded so that it can be
+ * revoked.
+ *
+ * @param env The CA bindings
+ * @param previous The certificate that was presented for renewal
+ * @param certificate The certificate issued by the renewal
+ * @returns true if the renewal was recorded, or false if the previous certificate was already revoked
+ */
+export const recordRenewal = async (env: SshCaBindings, previous: SshCertificate, certificate: SshCertificate): Promise<boolean> => {
+	// ensure migrations have been applied
+	await connect(env)
+
+	const columns = CertificateColumns.join(", ")
+	const placeholders = CertificateColumns.map(() => "?").join(", ")
+	const revokedAt = (new Date).toISOString()
+
+	const results = await env.DB.batch([
+		env.DB.prepare(`INSERT INTO certificates (${columns}) VALUES (${placeholders}) ON CONFLICT (serial) DO NOTHING`)
+			.bind(...certificateValues(previous, previous.keyId, CertificateType.Host)),
+		env.DB.prepare("UPDATE certificates SET revoked_at = ? WHERE serial = ? AND certificate_type = ? AND revoked_at IS NULL")
+			.bind(revokedAt, `${previous.serial}`, CertificateType.Host),
+		// changes() is the number of rows revoked by the previous statement
+		env.DB.prepare(`INSERT INTO certificates (${columns}) SELECT ${placeholders} WHERE changes() = 1`)
+			.bind(...certificateValues(certificate, certificate.keyId, CertificateType.Host)),
+		// the previous certificate was revoked if the renewed one was recorded
+		env.DB.prepare(BumpRevisionIfChanged).bind(CertificateType.Host),
+	])
+
+	if (results.some((res) => !res.success)) {
+		throw new Error("error during query")
+	}
+
+	return results[2]?.meta?.changes === 1
+}
+
 export const isRevoked = async (env: SshCaBindings, serial: bigint): Promise<boolean> => {
 	const qb = await connect(env)
 	const res = await qb.fetchOne({
@@ -95,21 +162,44 @@ export enum RevocationStatus {
 	NotFound,
 	Revoked,
 	Revokable,
-	Unrevokable
 }
 
-export const revocationStatus = async (env: SshCaBindings, serial: bigint, publickey: string, certificateType: CertificateType): Promise<RevocationStatus> => {
+// whether a public key recorded in OpenSSH format is the same as another key,
+// treating a recorded key that cannot be parsed as a different key
+const isKey = (recorded: string, publicKey: PublicKey): boolean => {
+	try {
+		return PublicKey.parse(recorded).equals(publicKey)
+	} catch {
+		return false
+	}
+}
+
+/**
+ * Returns whether a certificate can be revoked by the holder of a public key.
+ *
+ * The public key is compared by fingerprint, so a key with a different
+ * comment to the one the certificate was issued for still matches.
+ *
+ * @param env The CA bindings
+ * @param serial The serial of the certificate
+ * @param publicKey The public key the requester has proven possession of
+ * @param certificateType The type of certificate
+ * @returns The revocation status of the certificate
+ */
+export const revocationStatus = async (env: SshCaBindings, serial: bigint, publicKey: PublicKey, certificateType: CertificateType): Promise<RevocationStatus> => {
 	const qb = await connect(env)
 	const res = await qb.fetchOne({
 		tableName: "certificates",
 		fields: ["public_key", "revoked_at"],
 		where: {
-			conditions: "serial = ? AND public_key = ? AND certificate_type = ?",
-			params: [`${serial}`, publickey, certificateType]
+			conditions: "serial = ? AND certificate_type = ?",
+			params: [`${serial}`, certificateType]
 		}
 	}).execute()
 
-	if (res.results === undefined) {
+	// a certificate issued for another key is reported as not found, so
+	// requests cannot be used to discover which serials exist
+	if (res.results?.public_key == null || !isKey(res.results.public_key, publicKey)) {
 		return RevocationStatus.NotFound
 	}
 
@@ -117,11 +207,7 @@ export const revocationStatus = async (env: SshCaBindings, serial: bigint, publi
 		return RevocationStatus.Revoked
 	}
 
-	if (publickey === res.results.public_key) {
-		return RevocationStatus.Revokable
-	}
-
-	return RevocationStatus.Unrevokable
+	return RevocationStatus.Revokable
 }
 
 export const getRevocationList = async (env: SshCaBindings, certificateType: CertificateType): Promise<string[]> => {
@@ -148,38 +234,89 @@ export const getRevocationList = async (env: SshCaBindings, certificateType: Cer
 	return res.results.map(item => item.serial)
 }
 
-type RevokedCertificate = Pick<CertificateRecord, "revoked_at">
+/** The time a certificate was revoked, as an ISO 8601 string */
+type RevokedCertificate = { revoked_at: string }
 
+/**
+ * Revokes a certificate that has not already been revoked.
+ *
+ * A certificate that is already revoked is left unchanged, so when several
+ * requests revoke the same certificate concurrently only one of them revokes
+ * it and the time it was first revoked is kept.
+ *
+ * @param env The CA bindings
+ * @param serial The serial of the certificate to revoke
+ * @returns The revocation time of the certificate, or an empty array if it was not revoked by this call
+ */
 export const revokeCertificate = async (env: SshCaBindings, serial: bigint): Promise<RevokedCertificate[]> => {
-	const qb = await connect(env)
-	const res = await qb.update<RevokedCertificate>({
-		tableName: "certificates",
-		data: {
-			revoked_at: (new Date).toISOString()
-		},
-		where: {
-			conditions: "serial = ?",
-			params: `${serial}`
-		},
-		returning: ["revoked_at"]
-	}).execute()
+	// ensure migrations have been applied
+	await connect(env)
 
-	if (!res.success) {
+	const revokedAt = (new Date).toISOString()
+
+	// the KRL revision is incremented in the same transaction, so a cached KRL
+	// that does not include this certificate is never used again
+	const results = await env.DB.batch([
+		env.DB.prepare("UPDATE certificates SET revoked_at = ? WHERE serial = ? AND revoked_at IS NULL")
+			.bind(revokedAt, `${serial}`),
+		env.DB.prepare("UPDATE krl SET revision = revision + 1 WHERE certificate_type = (SELECT certificate_type FROM certificates WHERE serial = ?) AND changes() = 1")
+			.bind(`${serial}`),
+	])
+
+	if (results.some((res) => !res.success)) {
 		throw new Error("error during query")
 	}
 
-	if (res.results === undefined) {
-		return []
-	}
+	return results[0]?.meta?.changes === 1 ? [{ revoked_at: revokedAt }] : []
+}
+
+const KrlRevisionRow = z.object({
+	revision: z.number().int().nonnegative(),
+})
 
-	return res.results
+/**
+ * Returns the revision of the KRL for a certificate type, which is
+ * incremented whenever a certificate of that type is revoked.
+ *
+ * @param env The CA bindings
+ * @param certificateType The type of certificates in the KRL
+ * @returns The current revision
+ */
+export const getKrlRevision = async (env: SshCaBindings, certificateType: CertificateType): Promise<bigint> => {
+	const qb = await connect(env)
+	const res = await qb.fetchOne({
+		tableName: "krl",
+		fields: ["revision"],
+		where: {
+			conditions: "certificate_type = ?",
+			params: certificateType
+		}
+	}).execute()
+
+	return BigInt(KrlRevisionRow.parse(res.results).revision)
 }
 
 const KrlVersionRow = z.object({
 	version: z.number().int().nonnegative(),
 	digest: z.string().nullable(),
+	updated_at: z.string(),
 })
 
+/**
+ * Parses a timestamp from the database, which is either an ISO 8601 string or,
+ * when set by SQLite's CURRENT_TIMESTAMP, "YYYY-MM-DD HH:MM:SS" in UTC.
+ */
+const parseTimestamp = (value: string): Date => {
+	return new Date(/^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}$/.test(value) ? `${value.replace(" ", "T")}Z` : value)
+}
+
+/** The version of a KRL and when that version was generated */
+export type KrlVersion = {
+	version: bigint
+	/** When the version was first generated, which is the same for every KRL with this version */
+	generatedAt: Date
+}
+
 // the number of times to retry when another request updates the KRL version concurrently
 const KRL_VERSION_ATTEMPTS = 5
 
@@ -194,15 +331,16 @@ const KRL_VERSION_ATTEMPTS = 5
  * @param env The bindings for the CA, see {@link SshCaBindings}
  * @param certificateType The type of certificates in the KRL, see {@link CertificateType}
  * @param digest A digest of the content of the KRL, which changes whenever the content does
- * @returns The version to use for the KRL
+ * @returns The version to use for the KRL, and when that version was first
+ * generated so that every KRL with the version has the same generation date
  */
-export const getKrlVersion = async (env: SshCaBindings, certificateType: CertificateType, digest: string): Promise<bigint> => {
+export const getKrlVersion = async (env: SshCaBindings, certificateType: CertificateType, digest: string): Promise<KrlVersion> => {
 	const qb = await connect(env)
 
 	for (let attempt = 0; attempt < KRL_VERSION_ATTEMPTS; attempt++) {
 		const res = await qb.fetchOne({
 			tableName: "krl",
-			fields: ["version", "digest"],
+			fields: ["version", "digest", "updated_at"],
 			where: {
 				conditions: "certificate_type = ?",
 				params: certificateType
@@ -211,17 +349,19 @@ export const getKrlVersion = async (env: SshCaBindings, certificateType: Certifi
 
 		const current = KrlVersionRow.parse(res.results)
 		if (current.digest === digest) {
-			return BigInt(current.version)
+			return { version: BigInt(current.version), generatedAt: parseTimestamp(current.updated_at) }
 		}
 
-		// only update if the version has not been changed by another request
+		// only update if the version has not been changed by another request,
+		// recording the time to the second as that is all a KRL records
 		const next = current.version + 1
+		const generatedAt = new Date(Math.floor(Date.now() / 1000) * 1000)
 		const updated = await qb.update<Pick<KrlRecord, "version">>({
 			tableName: "krl",
 			data: {
 				version: next,
 				digest: digest,
-				updated_at: (new Date).toISOString()
+				updated_at: generatedAt.toISOString()
 			},
 			where: {
 				conditions: "certificate_type = ? AND version = ?",
@@ -235,7 +375,7 @@ export const getKrlVersion = async (env: SshCaBindings, certificateType: Certifi
 		}
 
 		if (updated.results !== undefined && updated.results.length > 0) {
-			return BigInt(next)
+			return { version: BigInt(next), generatedAt }
 		}
 	}
 

package/src/db/migrations/0003_krl_revision.ts

@@ -0,0 +1,15 @@
+import type { Migration } from "../migrate.js"
+
+export const migration: Migration = {
+	name: "0003_krl_revision",
+	statements: [
+		// incremented whenever a certificate is revoked, so a cached KRL can be
+		// keyed by the revision it was generated for
+		"ALTER TABLE krl ADD COLUMN revision INTEGER NOT NULL DEFAULT 0",
+		// KRLs were previously generated at the time of each request, but are
+		// now generated at the time their version last changed. Starting each
+		// version again from now ensures a KRL fetched before this migration
+		// is never newer than the same version fetched afterwards.
+		"UPDATE krl SET updated_at = CURRENT_TIMESTAMP",
+	]
+}

package/src/db/migrations/index.ts

@@ -1,8 +1,10 @@
 import type { Migration } from "../migrate.js"
 import { migration as initialSchema0001 } from "./0001_initial_schema.js"
 import { migration as krlVersion0002 } from "./0002_krl_version.js"
+import { migration as krlRevision0003 } from "./0003_krl_revision.js"
 
 export const migrations: Migration[] = [
 	initialSchema0001,
 	krlVersion0002,
+	krlRevision0003,
 ]

package/src/db/types.ts

@@ -31,6 +31,8 @@ export type KrlRecord = {
 	version: number
 	digest: string | null
 	updated_at: Date
+	/** Incremented whenever a certificate of this type is revoked */
+	revision: number
 }
 
 /** The tables in the database, used to type queries made with workers-qb */