@andrewheberle/serverless-ssh-ca 0.22.0 → 0.24.0

package/dist/certificate.js

@@ -1,13 +1,7 @@
 import { seconds } from "itty-time";
-import sshpk from "sshpk";
 import { getPrivateKey, split } from "./utils.js";
-// sshpk is CommonJS and Node's ESM loader cannot detect most of its named exports, so values are taken from the default import
-const { createCertificate, identityForHost, identityForUser, identityFromDN } = sshpk;
-/* const DefaultCreateCertificateOptions: CreateCertificateOptions = {
-    lifetime: seconds(env.SSH_CERTIFICATE_LIFETIME),
-    principals: [],
-    extensions: sshCertificateExtensions
-} */
+import { signCertificate } from "./ssh/certificate.js";
+import { createSigner } from "./ssh/signer.js";
 export class CertificateError extends Error {
     constructor(message) {
         super(message);
@@ -16,17 +10,32 @@ export class CertificateError extends Error {
         Object.setPrototypeOf(this, CertificateError.prototype);
     }
 }
-export const generateCertificate = (env, email, key, public_key, options) => {
-    let { lifetime } = options ?? {};
-    const { principals, extensions, serial } = options ?? {};
-    // add identities
+/**
+ * Signs a certificate with the CA key
+ *
+ * @throws {@link CertificateError} when the certificate has no principals,
+ * as OpenSSH accepts a certificate without principals for any user or host
+ */
+const sign = async (key, fields, lifetime) => {
+    if (fields.principals.length === 0) {
+        throw new CertificateError("a certificate must have at least one principal");
+    }
+    // the validity is to the second, so starts at the current second rather
+    // than in the future
+    const validAfter = new Date(Math.floor(Date.now() / 1000) * 1000);
+    const validBefore = new Date(validAfter.getTime() + lifetime * 1000);
+    return await signCertificate({ ...fields, validAfter, validBefore }, await createSigner(key));
+};
+export const generateCertificate = async (env, email, key, public_key, options) => {
+    const { lifetime, principals, extensions, serial } = options ?? {};
+    // add principals
     const includeSelf = env.SSH_CERTIFICATE_INCLUDE_SELF === undefined
         ? false
         : typeof env.SSH_CERTIFICATE_INCLUDE_SELF === "string"
             ? env.SSH_CERTIFICATE_INCLUDE_SELF === "true"
             : env.SSH_CERTIFICATE_INCLUDE_SELF;
-    const identity = includeSelf
-        ? [identityForUser(email.split("@")[0])]
+    const certificatePrincipals = includeSelf
+        ? [email.split("@")[0]]
         : [];
     // add email?
     const includeSelfEmail = env.SSH_CERTIFICATE_INCLUDE_SELF_EMAIL === undefined
@@ -35,69 +44,34 @@ export const generateCertificate = (env, email, key, public_key, options) => {
             ? env.SSH_CERTIFICATE_INCLUDE_SELF_EMAIL === "true"
             : env.SSH_CERTIFICATE_INCLUDE_SELF_EMAIL;
     if (includeSelfEmail) {
-        identity.push(identityForUser(email));
+        certificatePrincipals.push(email);
     }
     if (principals !== undefined) {
-        for (const p of principals) {
-            identity.push(identityForUser(p));
-        }
-    }
-    for (const p of split(env.SSH_CERTIFICATE_PRINCIPALS)) {
-        identity.push(identityForUser(p));
-    }
-    // lifetime is the smaller of what was provided in the options or the default
-    lifetime = lifetime !== undefined
-        ? Math.min(lifetime, seconds(env.SSH_CERTIFICATE_LIFETIME))
-        : seconds(env.SSH_CERTIFICATE_LIFETIME);
-    // generate value for serial of certificate
-    const s = generateSerial(serial);
-    // set issuer of certificate based on ISSUER_DN
-    const issuer = identityFromDN(env.ISSUER_DN);
-    // create certificate
-    const certificate = createCertificate(identity, public_key, issuer, key, { lifetime: lifetime, serial: s });
-    // ensure openssh info is included in certificate (should not occur)
-    if (certificate.signatures.openssh === undefined) {
-        throw new CertificateError("missing openssh information in certificate");
+        certificatePrincipals.push(...principals);
     }
+    certificatePrincipals.push(...split(env.SSH_CERTIFICATE_PRINCIPALS));
     const sshCertificateExtensions = split(env.SSH_CERTIFICATE_EXTENSIONS);
-    // add usage extensions
-    const sshextensions = [];
+    // if extensions are provided in request, ensure they do not include extra extensions beyond the defaults
     if (extensions !== undefined) {
-        // if extensions are provided in request, ensure they do not include extra extensions beyond the defaults
         for (const ext of extensions) {
             if (!sshCertificateExtensions.includes(ext)) {
                 throw new CertificateError(`${ext} is not allowed`);
             }
-            // add to list of allowed extensions
-            sshextensions.push({
-                critical: false,
-                name: ext,
-                data: Buffer.alloc(0)
-            });
         }
     }
-    else {
+    // lifetime is the smaller of what was provided in the options or the default
+    const certificateLifetime = lifetime !== undefined
+        ? Math.min(lifetime, seconds(env.SSH_CERTIFICATE_LIFETIME))
+        : seconds(env.SSH_CERTIFICATE_LIFETIME);
+    return await sign(key, {
+        kind: "user",
+        publicKey: public_key,
+        serial: serial ?? generateSerial(),
+        keyId: email,
+        principals: certificatePrincipals,
         // use defaults if not provided
-        sshCertificateExtensions.forEach((ext) => {
-            sshextensions.push({
-                critical: false,
-                name: ext,
-                data: Buffer.alloc(0)
-            });
-        });
-    }
-    // add info to certificate
-    certificate.signatures = {
-        openssh: {
-            nonce: certificate.signatures.openssh.nonce,
-            keyId: email,
-            signature: certificate.signatures.openssh.signature,
-            exts: sshextensions
-        }
-    };
-    // re-sign after changes
-    certificate.signWith(key);
-    return certificate;
+        extensions: extensions ?? sshCertificateExtensions,
+    }, certificateLifetime);
 };
 export async function createSignedCertificate(env, email, public_key, options) {
     // grab private key from secret store
@@ -109,7 +83,7 @@ export async function createSignedCertificate(env, email, public_key, options) {
             extensions: split(env.SSH_CERTIFICATE_EXTENSIONS)
         };
     }
-    return generateCertificate(env, email, key, public_key, options);
+    return await generateCertificate(env, email, key, public_key, options);
 }
 export class BadIssuerError extends Error {
     constructor(message) {
@@ -119,44 +93,26 @@ export class BadIssuerError extends Error {
     }
 }
 export async function createSignedHostCertificate(env, public_key, options) {
-    if (options === undefined) {
-        options = {
-            lifetime: seconds(env.SSH_HOST_CERTIFICATE_LIFETIME),
-            principals: []
-        };
-    }
-    // generate list of identities for host key
-    const identity = [];
-    if (options.principals !== undefined) {
-        for (const p of options.principals) {
-            identity.push(identityForHost(p));
-        }
-    }
-    // add any already provided subjects (for renewals only)
-    if (options.subjects !== undefined) {
-        identity.push(...options.subjects);
-    }
+    const principals = options?.principals ?? [];
     // grab private key from secret store
     const key = await getPrivateKey(env);
     // lifetime is the smaller of what was provided in the options or the default
-    const lifetime = options.lifetime !== undefined
+    const lifetime = options?.lifetime !== undefined
         ? Math.min(options.lifetime, seconds(env.SSH_HOST_CERTIFICATE_LIFETIME))
         : seconds(env.SSH_HOST_CERTIFICATE_LIFETIME);
-    // generate value for serial of certificate
-    const serial = generateSerial();
-    // set issuer of certificate based on ISSUER_DN
-    const issuer = identityFromDN(env.ISSUER_DN);
-    // create certificate
-    const certificate = createCertificate(identity, public_key, issuer, key, { lifetime: lifetime, serial: serial });
-    return certificate;
+    return await sign(key, {
+        kind: "host",
+        publicKey: public_key,
+        serial: generateSerial(),
+        keyId: `host_${principals[0]}`,
+        principals,
+        extensions: [],
+    }, lifetime);
 }
-export const generateSerial = (serial) => {
-    if (serial !== undefined) {
-        const s = Buffer.alloc(8);
-        s.writeBigUInt64BE(serial);
-        return s;
-    }
-    const randomBytes = crypto.getRandomValues(new Uint8Array(8));
-    return Buffer.from(randomBytes);
+/**
+ * Returns a random certificate serial number
+ */
+export const generateSerial = () => {
+    return new DataView(crypto.getRandomValues(new Uint8Array(8)).buffer).getBigUint64(0);
 };
 //# sourceMappingURL=certificate.js.map

package/dist/certificate.js.map

@@ -1 +1 @@
-{"version":3,"file":"certificate.js","sourceRoot":"","sources":["../src/certificate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,KAAK,MAAM,OAAO,CAAA;AAGzB,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAGjD,+HAA+H;AAC/H,MAAM,EAAE,iBAAiB,EAAE,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,GAAG,KAAK,CAAA;AAUrF;;;;IAII;AAEJ,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAC1C,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAA;QAE9B,yDAAyD;QACzD,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAA;IACxD,CAAC;CACD;AAWD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,GAAkB,EAAE,KAAa,EAAE,GAAe,EAAE,UAAe,EAAE,OAAoC,EAAe,EAAE;IAC7J,IAAI,EAAE,QAAQ,EAAE,GAAG,OAAO,IAAI,EAAE,CAAA;IAChC,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,OAAO,IAAI,EAAE,CAAA;IAExD,iBAAiB;IACjB,MAAM,WAAW,GAAG,GAAG,CAAC,4BAA4B,KAAK,SAAS;QACjE,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,OAAO,GAAG,CAAC,4BAA4B,KAAK,QAAQ;YACrD,CAAC,CAAC,GAAG,CAAC,4BAA4B,KAAK,MAAM;YAC7C,CAAC,CAAC,GAAG,CAAC,4BAA4B,CAAA;IACpC,MAAM,QAAQ,GAAG,WAAW;QAC3B,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;QACzC,CAAC,CAAC,EAAE,CAAA;IAEL,aAAa;IACb,MAAM,gBAAgB,GAAG,GAAG,CAAC,kCAAkC,KAAK,SAAS;QAC5E,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,OAAO,GAAG,CAAC,kCAAkC,KAAK,QAAQ;YAC3D,CAAC,CAAC,GAAG,CAAC,kCAAkC,KAAK,MAAM;YACnD,CAAC,CAAC,GAAG,CAAC,kCAAkC,CAAA;IAC1C,IAAI,gBAAgB,EAAE,CAAC;QACtB,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAA;IACtC,CAAC;IAED,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC9B,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC5B,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAA;QAClC,CAAC;IACF,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,0BAA0B,CAAC,EAAE,CAAC;QACvD,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAA;IAClC,CAAC;IAGD,6EAA6E;IAC7E,QAAQ,GAAG,QAAQ,KAAK,SAAS;QAChC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QAC3D,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAA;IAExC,2CAA2C;IAC3C,MAAM,CAAC,GAAG,cAAc,CAAC,MAAM,CAAC,CAAA;IAEhC,+CAA+C;IAC/C,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IAE5C,qBAAqB;IACrB,MAAM,WAAW,GAAG,iBAAiB,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAA;IAE3G,oEAAoE;IACpE,IAAI,WAAW,CAAC,UAAU,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAClD,MAAM,IAAI,gBAAgB,CAAC,4CAA4C,CAAC,CAAA;IACzE,CAAC;IAED,MAAM,wBAAwB,GAAG,KAAK,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAA;IAEtE,uBAAuB;IACvB,MAAM,aAAa,GAAmB,EAAE,CAAA;IACxC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC9B,yGAAyG;QACzG,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;YAC9B,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7C,MAAM,IAAI,gBAAgB,CAAC,GAAG,GAAG,iBAAiB,CAAC,CAAA;YACpD,CAAC;YAED,oCAAoC;YACpC,aAAa,CAAC,IAAI,CAAC;gBAClB,QAAQ,EAAE,KAAK;gBACf,IAAI,EAAE,GAAG;gBACT,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;aACrB,CAAC,CAAA;QACH,CAAC;IACF,CAAC;SAAM,CAAC;QACP,+BAA+B;QAC/B,wBAAwB,CAAC,OAAO,CAAC,CAAC,GAAW,EAAE,EAAE;YAChD,aAAa,CAAC,IAAI,CAAC;gBAClB,QAAQ,EAAE,KAAK;gBACf,IAAI,EAAE,GAAG;gBACT,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;aACrB,CAAC,CAAA;QACH,CAAC,CAAC,CAAA;IAEH,CAAC;IAED,0BAA0B;IAC1B,WAAW,CAAC,UAAU,GAAG;QACxB,OAAO,EAAE;YACR,KAAK,EAAE,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK;YAC3C,KAAK,EAAE,KAAK;YACZ,SAAS,EAAE,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS;YACnD,IAAI,EAAE,aAAa;SACnB;KACD,CAAA;IAED,wBAAwB;IACxB,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;IAEzB,OAAO,WAAW,CAAA;AACnB,CAAC,CAAA;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,GAAkB,EAAE,KAAa,EAAE,UAAe,EAAE,OAAkC;IACnI,qCAAqC;IACrC,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAA;IAEpC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,GAAG;YACT,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;YAC/C,UAAU,EAAE,EAAE;YACd,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,0BAA0B,CAAC;SACjD,CAAA;IACF,CAAC;IAED,OAAO,mBAAmB,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;AACjE,CAAC;AAQD,MAAM,OAAO,cAAe,SAAQ,KAAK;IACxC,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAA;QAE5B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,cAAc,CAAC,SAAS,CAAC,CAAA;IACtD,CAAC;CACD;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,GAAkB,EAAE,UAAe,EAAE,OAAsC;IAC5H,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,GAAG;YACT,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC;YACpD,UAAU,EAAE,EAAE;SACd,CAAA;IACF,CAAC;IACD,2CAA2C;IAC3C,MAAM,QAAQ,GAAe,EAAE,CAAA;IAC/B,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACtC,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACpC,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAA;QAClC,CAAC;IACF,CAAC;IAED,wDAAwD;IACxD,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACpC,QAAQ,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IACnC,CAAC;IAED,qCAAqC;IACrC,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAA;IAEpC,6EAA6E;IAC7E,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,KAAK,SAAS;QAC9C,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;QACxE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAA;IAE7C,2CAA2C;IAC3C,MAAM,MAAM,GAAG,cAAc,EAAE,CAAA;IAE/B,+CAA+C;IAC/C,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IAE5C,qBAAqB;IACrB,MAAM,WAAW,GAAG,iBAAiB,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;IAEhH,OAAO,WAAW,CAAA;AACnB,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,MAAe,EAAuB,EAAE;IACtE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QACzB,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAA;QAE1B,OAAO,CAAC,CAAA;IACT,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAA;IAC7D,OAAO,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;AAChC,CAAC,CAAA"}
+{"version":3,"file":"certificate.js","sourceRoot":"","sources":["../src/certificate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAEnC,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAEjD,OAAO,EAAE,eAAe,EAA+C,MAAM,sBAAsB,CAAA;AACnG,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAQ9C,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAC1C,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAA;QAE9B,yDAAyD;QACzD,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAA;IACxD,CAAC;CACD;AAWD;;;;;GAKG;AACH,MAAM,IAAI,GAAG,KAAK,EAAE,GAAe,EAAE,MAA6D,EAAE,QAAgB,EAA2B,EAAE;IAChJ,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,gBAAgB,CAAC,gDAAgD,CAAC,CAAA;IAC7E,CAAC;IAED,wEAAwE;IACxE,qBAAqB;IACrB,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAA;IACjE,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,QAAQ,GAAG,IAAI,CAAC,CAAA;IAEpE,OAAO,MAAM,eAAe,CAAC,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,EAAE,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC,CAAA;AAC9F,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EAAE,GAAkB,EAAE,KAAa,EAAE,GAAe,EAAE,UAAqB,EAAE,OAAoC,EAA2B,EAAE;IACrL,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,OAAO,IAAI,EAAE,CAAA;IAElE,iBAAiB;IACjB,MAAM,WAAW,GAAG,GAAG,CAAC,4BAA4B,KAAK,SAAS;QACjE,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,OAAO,GAAG,CAAC,4BAA4B,KAAK,QAAQ;YACrD,CAAC,CAAC,GAAG,CAAC,4BAA4B,KAAK,MAAM;YAC7C,CAAC,CAAC,GAAG,CAAC,4BAA4B,CAAA;IACpC,MAAM,qBAAqB,GAAG,WAAW;QACxC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;QACxB,CAAC,CAAC,EAAE,CAAA;IAEL,aAAa;IACb,MAAM,gBAAgB,GAAG,GAAG,CAAC,kCAAkC,KAAK,SAAS;QAC5E,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,OAAO,GAAG,CAAC,kCAAkC,KAAK,QAAQ;YAC3D,CAAC,CAAC,GAAG,CAAC,kCAAkC,KAAK,MAAM;YACnD,CAAC,CAAC,GAAG,CAAC,kCAAkC,CAAA;IAC1C,IAAI,gBAAgB,EAAE,CAAC;QACtB,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAClC,CAAC;IAED,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC9B,qBAAqB,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,CAAA;IAC1C,CAAC;IAED,qBAAqB,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC,CAAA;IAEpE,MAAM,wBAAwB,GAAG,KAAK,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAA;IAEtE,yGAAyG;IACzG,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC9B,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;YAC9B,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7C,MAAM,IAAI,gBAAgB,CAAC,GAAG,GAAG,iBAAiB,CAAC,CAAA;YACpD,CAAC;QACF,CAAC;IACF,CAAC;IAED,6EAA6E;IAC7E,MAAM,mBAAmB,GAAG,QAAQ,KAAK,SAAS;QACjD,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QAC3D,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAA;IAExC,OAAO,MAAM,IAAI,CAAC,GAAG,EAAE;QACtB,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,UAAU;QACrB,MAAM,EAAE,MAAM,IAAI,cAAc,EAAE;QAClC,KAAK,EAAE,KAAK;QACZ,UAAU,EAAE,qBAAqB;QACjC,+BAA+B;QAC/B,UAAU,EAAE,UAAU,IAAI,wBAAwB;KAClD,EAAE,mBAAmB,CAAC,CAAA;AACxB,CAAC,CAAA;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,GAAkB,EAAE,KAAa,EAAE,UAAqB,EAAE,OAAkC;IACzI,qCAAqC;IACrC,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAA;IAEpC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,GAAG;YACT,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;YAC/C,UAAU,EAAE,EAAE;YACd,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,0BAA0B,CAAC;SACjD,CAAA;IACF,CAAC;IAED,OAAO,MAAM,mBAAmB,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;AACvE,CAAC;AAOD,MAAM,OAAO,cAAe,SAAQ,KAAK;IACxC,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAA;QAE5B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,cAAc,CAAC,SAAS,CAAC,CAAA;IACtD,CAAC;CACD;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,GAAkB,EAAE,UAAqB,EAAE,OAAsC;IAClI,MAAM,UAAU,GAAG,OAAO,EAAE,UAAU,IAAI,EAAE,CAAA;IAE5C,qCAAqC;IACrC,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAA;IAEpC,6EAA6E;IAC7E,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,KAAK,SAAS;QAC/C,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;QACxE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAA;IAE7C,OAAO,MAAM,IAAI,CAAC,GAAG,EAAE;QACtB,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,UAAU;QACrB,MAAM,EAAE,cAAc,EAAE;QACxB,KAAK,EAAE,QAAQ,UAAU,CAAC,CAAC,CAAC,EAAE;QAC9B,UAAU;QACV,UAAU,EAAE,EAAE;KACd,EAAE,QAAQ,CAAC,CAAA;AACb,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,GAAW,EAAE;IAC1C,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;AACtF,CAAC,CAAA"}

package/dist/db/index.d.ts

@@ -1,19 +1,77 @@
-import type { Certificate } from "sshpk";
+import { PublicKey } from "../ssh/keys.js";
+import type { SshCertificate } from "../ssh/certificate.js";
 import type { SshCaBindings } from "../types.js";
-import { CertificateType, type CertificateRecord } from "./types.js";
+import { CertificateType } from "./types.js";
 export declare const dbCleanup: (env: SshCaBindings) => Promise<void>;
-export declare const recordCertificate: (env: SshCaBindings, certificate: Certificate, keyid: string, certificateType?: CertificateType) => Promise<void>;
+export declare const recordCertificate: (env: SshCaBindings, certificate: SshCertificate, keyid: string, certificateType?: CertificateType) => Promise<void>;
+/**
+ * Records a host certificate issued by renewing another, revoking the
+ * certificate that was renewed so it cannot be used or renewed again.
+ *
+ * This is done in a single transaction, and the renewed certificate is only
+ * recorded if this call revoked the previous certificate, so when a
+ * certificate is renewed more than once concurrently only one renewal is
+ * recorded. A previous certificate that was never recorded (for example one
+ * signed with the CA key outside of the CA) is recorded so that it can be
+ * revoked.
+ *
+ * @param env The CA bindings
+ * @param previous The certificate that was presented for renewal
+ * @param certificate The certificate issued by the renewal
+ * @returns true if the renewal was recorded, or false if the previous certificate was already revoked
+ */
+export declare const recordRenewal: (env: SshCaBindings, previous: SshCertificate, certificate: SshCertificate) => Promise<boolean>;
 export declare const isRevoked: (env: SshCaBindings, serial: bigint) => Promise<boolean>;
 export declare enum RevocationStatus {
     NotFound = 0,
     Revoked = 1,
-    Revokable = 2,
-    Unrevokable = 3
+    Revokable = 2
 }
-export declare const revocationStatus: (env: SshCaBindings, serial: bigint, publickey: string, certificateType: CertificateType) => Promise<RevocationStatus>;
+/**
+ * Returns whether a certificate can be revoked by the holder of a public key.
+ *
+ * The public key is compared by fingerprint, so a key with a different
+ * comment to the one the certificate was issued for still matches.
+ *
+ * @param env The CA bindings
+ * @param serial The serial of the certificate
+ * @param publicKey The public key the requester has proven possession of
+ * @param certificateType The type of certificate
+ * @returns The revocation status of the certificate
+ */
+export declare const revocationStatus: (env: SshCaBindings, serial: bigint, publicKey: PublicKey, certificateType: CertificateType) => Promise<RevocationStatus>;
 export declare const getRevocationList: (env: SshCaBindings, certificateType: CertificateType) => Promise<string[]>;
-type RevokedCertificate = Pick<CertificateRecord, "revoked_at">;
+/** The time a certificate was revoked, as an ISO 8601 string */
+type RevokedCertificate = {
+    revoked_at: string;
+};
+/**
+ * Revokes a certificate that has not already been revoked.
+ *
+ * A certificate that is already revoked is left unchanged, so when several
+ * requests revoke the same certificate concurrently only one of them revokes
+ * it and the time it was first revoked is kept.
+ *
+ * @param env The CA bindings
+ * @param serial The serial of the certificate to revoke
+ * @returns The revocation time of the certificate, or an empty array if it was not revoked by this call
+ */
 export declare const revokeCertificate: (env: SshCaBindings, serial: bigint) => Promise<RevokedCertificate[]>;
+/**
+ * Returns the revision of the KRL for a certificate type, which is
+ * incremented whenever a certificate of that type is revoked.
+ *
+ * @param env The CA bindings
+ * @param certificateType The type of certificates in the KRL
+ * @returns The current revision
+ */
+export declare const getKrlRevision: (env: SshCaBindings, certificateType: CertificateType) => Promise<bigint>;
+/** The version of a KRL and when that version was generated */
+export type KrlVersion = {
+    version: bigint;
+    /** When the version was first generated, which is the same for every KRL with this version */
+    generatedAt: Date;
+};
 /**
  * Get the version of the KRL for a certificate type, incrementing it if the
  * content of the KRL has changed since the version was last returned.
@@ -25,8 +83,9 @@ export declare const revokeCertificate: (env: SshCaBindings, serial: bigint) =>
  * @param env The bindings for the CA, see {@link SshCaBindings}
  * @param certificateType The type of certificates in the KRL, see {@link CertificateType}
  * @param digest A digest of the content of the KRL, which changes whenever the content does
- * @returns The version to use for the KRL
+ * @returns The version to use for the KRL, and when that version was first
+ * generated so that every KRL with the version has the same generation date
  */
-export declare const getKrlVersion: (env: SshCaBindings, certificateType: CertificateType, digest: string) => Promise<bigint>;
+export declare const getKrlVersion: (env: SshCaBindings, certificateType: CertificateType, digest: string) => Promise<KrlVersion>;
 export {};
 //# sourceMappingURL=index.d.ts.map

package/dist/db/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/db/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAoB,MAAM,OAAO,CAAA;AAE1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAKhD,OAAO,EAAE,eAAe,EAAE,KAAK,iBAAiB,EAAuC,MAAM,YAAY,CAAA;AAmBzG,eAAO,MAAM,SAAS,QAAe,aAAa,kBAsBjD,CAAA;AAED,eAAO,MAAM,iBAAiB,QAAe,aAAa,eAAe,WAAW,SAAS,MAAM,oBAAmB,eAAe,kBA2BpI,CAAA;AAED,eAAO,MAAM,SAAS,QAAe,aAAa,UAAU,MAAM,KAAG,OAAO,CAAC,OAAO,CAYnF,CAAA;AAED,oBAAY,gBAAgB;IAC3B,QAAQ,IAAA;IACR,OAAO,IAAA;IACP,SAAS,IAAA;IACT,WAAW,IAAA;CACX;AAED,eAAO,MAAM,gBAAgB,QAAe,aAAa,UAAU,MAAM,aAAa,MAAM,mBAAmB,eAAe,KAAG,OAAO,CAAC,gBAAgB,CAwBxJ,CAAA;AAED,eAAO,MAAM,iBAAiB,QAAe,aAAa,mBAAmB,eAAe,KAAG,OAAO,CAAC,MAAM,EAAE,CAsB9G,CAAA;AAED,KAAK,kBAAkB,GAAG,IAAI,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAA;AAE/D,eAAO,MAAM,iBAAiB,QAAe,aAAa,UAAU,MAAM,KAAG,OAAO,CAAC,kBAAkB,EAAE,CAuBxG,CAAA;AAUD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,aAAa,QAAe,aAAa,mBAAmB,eAAe,UAAU,MAAM,KAAG,OAAO,CAAC,MAAM,CA4CxH,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/db/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAE3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAKhD,OAAO,EAAE,eAAe,EAAuC,MAAM,YAAY,CAAA;AA2BjF,eAAO,MAAM,SAAS,QAAe,aAAa,kBA4BjD,CAAA;AA4BD,eAAO,MAAM,iBAAiB,QAAe,aAAa,eAAe,cAAc,SAAS,MAAM,oBAAmB,eAAe,kBAUvI,CAAA;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,aAAa,QAAe,aAAa,YAAY,cAAc,eAAe,cAAc,KAAG,OAAO,CAAC,OAAO,CAyB9H,CAAA;AAED,eAAO,MAAM,SAAS,QAAe,aAAa,UAAU,MAAM,KAAG,OAAO,CAAC,OAAO,CAYnF,CAAA;AAED,oBAAY,gBAAgB;IAC3B,QAAQ,IAAA;IACR,OAAO,IAAA;IACP,SAAS,IAAA;CACT;AAYD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,gBAAgB,QAAe,aAAa,UAAU,MAAM,aAAa,SAAS,mBAAmB,eAAe,KAAG,OAAO,CAAC,gBAAgB,CAsB3J,CAAA;AAED,eAAO,MAAM,iBAAiB,QAAe,aAAa,mBAAmB,eAAe,KAAG,OAAO,CAAC,MAAM,EAAE,CAsB9G,CAAA;AAED,gEAAgE;AAChE,KAAK,kBAAkB,GAAG;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,CAAA;AAEhD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB,QAAe,aAAa,UAAU,MAAM,KAAG,OAAO,CAAC,kBAAkB,EAAE,CAoBxG,CAAA;AAMD;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,QAAe,aAAa,mBAAmB,eAAe,KAAG,OAAO,CAAC,MAAM,CAYzG,CAAA;AAgBD,+DAA+D;AAC/D,MAAM,MAAM,UAAU,GAAG;IACxB,OAAO,EAAE,MAAM,CAAA;IACf,8FAA8F;IAC9F,WAAW,EAAE,IAAI,CAAA;CACjB,CAAA;AAKD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,aAAa,QAAe,aAAa,mBAAmB,eAAe,UAAU,MAAM,KAAG,OAAO,CAAC,UAAU,CA8C5H,CAAA"}

package/dist/db/index.js

@@ -1,3 +1,4 @@
+import { PublicKey } from "../ssh/keys.js";
 import { logger } from "../logger.js";
 import { D1QB } from "workers-qb";
 import { z } from "zod";
@@ -17,6 +18,12 @@ const connect = async (env) => {
         throw err;
     }
 };
+// statements that increment the KRL revision, so a KRL cached for an earlier
+// revision is not used again
+const BumpAllRevisions = "UPDATE krl SET revision = revision + 1";
+// increments the revision of the KRL for a certificate type, but only if the
+// previous statement in the same batch changed a row
+const BumpRevisionIfChanged = "UPDATE krl SET revision = revision + 1 WHERE certificate_type = ? AND changes() = 1";
 export const dbCleanup = async (env) => {
     const l = logger(env).with("retention", env.DB_CERTIFICATE_RETENTION);
     if (env.DB_CERTIFICATE_RETENTION === "infinite") {
@@ -34,38 +41,86 @@ export const dbCleanup = async (env) => {
             }
         }).execute();
         l.info("completed database cleanup", "changes", res.meta?.changes);
+        // revoked certificates may have been removed from the KRLs, so cached
+        // KRLs must not be used again
+        if ((res.meta?.changes ?? 0) > 0) {
+            await env.DB.prepare(BumpAllRevisions).run();
+        }
     }
     catch (err) {
         l.error("error during database cleanup", "retention", env.DB_CERTIFICATE_RETENTION, "error", err);
     }
 };
+// the columns recorded for an issued certificate, in the order of the values
+// returned by certificateValues
+const CertificateColumns = ["serial", "key_id", "principals", "extensions", "valid_after", "valid_before", "certificate_type", "public_key"];
+const certificateRecord = (certificate, keyid, certificateType) => {
+    // principals are recorded as distinguished names, as they were when
+    // certificates were created with sshpk
+    const principals = certificate.principals.map((p) => `${certificate.kind === "host" ? "CN" : "UID"}=${p}`).join(",");
+    return {
+        serial: `${certificate.serial}`,
+        key_id: keyid,
+        principals: principals,
+        extensions: certificate.extensions.join(","),
+        valid_after: certificate.validAfter.toISOString(),
+        valid_before: certificate.validBefore.toISOString(),
+        certificate_type: certificateType,
+        public_key: certificate.publicKey.toString()
+    };
+};
+const certificateValues = (certificate, keyid, certificateType) => {
+    const record = certificateRecord(certificate, keyid, certificateType);
+    return CertificateColumns.map((column) => record[column]);
+};
 export const recordCertificate = async (env, certificate, keyid, certificateType = CertificateType.User) => {
-    const serial = certificate.serial.readBigUInt64BE(0);
-    const subjects = certificate.subjects.map((v) => {
-        return v.toString();
-    }).join(",");
-    const extensions = certificate.getExtensions().map((v) => {
-        // @ts-expect-error: the name property does exist
-        return v.name;
-    }).join(",");
     const qb = await connect(env);
     const res = await qb.insert({
         tableName: "certificates",
-        data: {
-            serial: `${serial}`,
-            key_id: keyid,
-            principals: subjects,
-            extensions: extensions,
-            valid_after: certificate.validFrom.toISOString(),
-            valid_before: certificate.validUntil.toISOString(),
-            certificate_type: certificateType,
-            public_key: certificate.subjectKey.toString("ssh")
-        },
+        data: certificateRecord(certificate, keyid, certificateType),
     }).execute();
     if (!res.success) {
         throw new Error("error during query");
     }
 };
+/**
+ * Records a host certificate issued by renewing another, revoking the
+ * certificate that was renewed so it cannot be used or renewed again.
+ *
+ * This is done in a single transaction, and the renewed certificate is only
+ * recorded if this call revoked the previous certificate, so when a
+ * certificate is renewed more than once concurrently only one renewal is
+ * recorded. A previous certificate that was never recorded (for example one
+ * signed with the CA key outside of the CA) is recorded so that it can be
+ * revoked.
+ *
+ * @param env The CA bindings
+ * @param previous The certificate that was presented for renewal
+ * @param certificate The certificate issued by the renewal
+ * @returns true if the renewal was recorded, or false if the previous certificate was already revoked
+ */
+export const recordRenewal = async (env, previous, certificate) => {
+    // ensure migrations have been applied
+    await connect(env);
+    const columns = CertificateColumns.join(", ");
+    const placeholders = CertificateColumns.map(() => "?").join(", ");
+    const revokedAt = (new Date).toISOString();
+    const results = await env.DB.batch([
+        env.DB.prepare(`INSERT INTO certificates (${columns}) VALUES (${placeholders}) ON CONFLICT (serial) DO NOTHING`)
+            .bind(...certificateValues(previous, previous.keyId, CertificateType.Host)),
+        env.DB.prepare("UPDATE certificates SET revoked_at = ? WHERE serial = ? AND certificate_type = ? AND revoked_at IS NULL")
+            .bind(revokedAt, `${previous.serial}`, CertificateType.Host),
+        // changes() is the number of rows revoked by the previous statement
+        env.DB.prepare(`INSERT INTO certificates (${columns}) SELECT ${placeholders} WHERE changes() = 1`)
+            .bind(...certificateValues(certificate, certificate.keyId, CertificateType.Host)),
+        // the previous certificate was revoked if the renewed one was recorded
+        env.DB.prepare(BumpRevisionIfChanged).bind(CertificateType.Host),
+    ]);
+    if (results.some((res) => !res.success)) {
+        throw new Error("error during query");
+    }
+    return results[2]?.meta?.changes === 1;
+};
 export const isRevoked = async (env, serial) => {
     const qb = await connect(env);
     const res = await qb.fetchOne({
@@ -83,28 +138,48 @@ export var RevocationStatus;
     RevocationStatus[RevocationStatus["NotFound"] = 0] = "NotFound";
     RevocationStatus[RevocationStatus["Revoked"] = 1] = "Revoked";
     RevocationStatus[RevocationStatus["Revokable"] = 2] = "Revokable";
-    RevocationStatus[RevocationStatus["Unrevokable"] = 3] = "Unrevokable";
 })(RevocationStatus || (RevocationStatus = {}));
-export const revocationStatus = async (env, serial, publickey, certificateType) => {
+// whether a public key recorded in OpenSSH format is the same as another key,
+// treating a recorded key that cannot be parsed as a different key
+const isKey = (recorded, publicKey) => {
+    try {
+        return PublicKey.parse(recorded).equals(publicKey);
+    }
+    catch {
+        return false;
+    }
+};
+/**
+ * Returns whether a certificate can be revoked by the holder of a public key.
+ *
+ * The public key is compared by fingerprint, so a key with a different
+ * comment to the one the certificate was issued for still matches.
+ *
+ * @param env The CA bindings
+ * @param serial The serial of the certificate
+ * @param publicKey The public key the requester has proven possession of
+ * @param certificateType The type of certificate
+ * @returns The revocation status of the certificate
+ */
+export const revocationStatus = async (env, serial, publicKey, certificateType) => {
     const qb = await connect(env);
     const res = await qb.fetchOne({
         tableName: "certificates",
         fields: ["public_key", "revoked_at"],
         where: {
-            conditions: "serial = ? AND public_key = ? AND certificate_type = ?",
-            params: [`${serial}`, publickey, certificateType]
+            conditions: "serial = ? AND certificate_type = ?",
+            params: [`${serial}`, certificateType]
         }
     }).execute();
-    if (res.results === undefined) {
+    // a certificate issued for another key is reported as not found, so
+    // requests cannot be used to discover which serials exist
+    if (res.results?.public_key == null || !isKey(res.results.public_key, publicKey)) {
         return RevocationStatus.NotFound;
     }
     if (res.results.revoked_at !== null) {
         return RevocationStatus.Revoked;
     }
-    if (publickey === res.results.public_key) {
-        return RevocationStatus.Revokable;
-    }
-    return RevocationStatus.Unrevokable;
+    return RevocationStatus.Revokable;
 };
 export const getRevocationList = async (env, certificateType) => {
     const qb = await connect(env);
@@ -126,31 +201,69 @@ export const getRevocationList = async (env, certificateType) => {
     }
     return res.results.map(item => item.serial);
 };
+/**
+ * Revokes a certificate that has not already been revoked.
+ *
+ * A certificate that is already revoked is left unchanged, so when several
+ * requests revoke the same certificate concurrently only one of them revokes
+ * it and the time it was first revoked is kept.
+ *
+ * @param env The CA bindings
+ * @param serial The serial of the certificate to revoke
+ * @returns The revocation time of the certificate, or an empty array if it was not revoked by this call
+ */
 export const revokeCertificate = async (env, serial) => {
+    // ensure migrations have been applied
+    await connect(env);
+    const revokedAt = (new Date).toISOString();
+    // the KRL revision is incremented in the same transaction, so a cached KRL
+    // that does not include this certificate is never used again
+    const results = await env.DB.batch([
+        env.DB.prepare("UPDATE certificates SET revoked_at = ? WHERE serial = ? AND revoked_at IS NULL")
+            .bind(revokedAt, `${serial}`),
+        env.DB.prepare("UPDATE krl SET revision = revision + 1 WHERE certificate_type = (SELECT certificate_type FROM certificates WHERE serial = ?) AND changes() = 1")
+            .bind(`${serial}`),
+    ]);
+    if (results.some((res) => !res.success)) {
+        throw new Error("error during query");
+    }
+    return results[0]?.meta?.changes === 1 ? [{ revoked_at: revokedAt }] : [];
+};
+const KrlRevisionRow = z.object({
+    revision: z.number().int().nonnegative(),
+});
+/**
+ * Returns the revision of the KRL for a certificate type, which is
+ * incremented whenever a certificate of that type is revoked.
+ *
+ * @param env The CA bindings
+ * @param certificateType The type of certificates in the KRL
+ * @returns The current revision
+ */
+export const getKrlRevision = async (env, certificateType) => {
     const qb = await connect(env);
-    const res = await qb.update({
-        tableName: "certificates",
-        data: {
-            revoked_at: (new Date).toISOString()
-        },
+    const res = await qb.fetchOne({
+        tableName: "krl",
+        fields: ["revision"],
         where: {
-            conditions: "serial = ?",
-            params: `${serial}`
-        },
-        returning: ["revoked_at"]
+            conditions: "certificate_type = ?",
+            params: certificateType
+        }
     }).execute();
-    if (!res.success) {
-        throw new Error("error during query");
-    }
-    if (res.results === undefined) {
-        return [];
-    }
-    return res.results;
+    return BigInt(KrlRevisionRow.parse(res.results).revision);
 };
 const KrlVersionRow = z.object({
     version: z.number().int().nonnegative(),
     digest: z.string().nullable(),
+    updated_at: z.string(),
 });
+/**
+ * Parses a timestamp from the database, which is either an ISO 8601 string or,
+ * when set by SQLite's CURRENT_TIMESTAMP, "YYYY-MM-DD HH:MM:SS" in UTC.
+ */
+const parseTimestamp = (value) => {
+    return new Date(/^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}$/.test(value) ? `${value.replace(" ", "T")}Z` : value);
+};
 // the number of times to retry when another request updates the KRL version concurrently
 const KRL_VERSION_ATTEMPTS = 5;
 /**
@@ -164,14 +277,15 @@ const KRL_VERSION_ATTEMPTS = 5;
  * @param env The bindings for the CA, see {@link SshCaBindings}
  * @param certificateType The type of certificates in the KRL, see {@link CertificateType}
  * @param digest A digest of the content of the KRL, which changes whenever the content does
- * @returns The version to use for the KRL
+ * @returns The version to use for the KRL, and when that version was first
+ * generated so that every KRL with the version has the same generation date
  */
 export const getKrlVersion = async (env, certificateType, digest) => {
     const qb = await connect(env);
     for (let attempt = 0; attempt < KRL_VERSION_ATTEMPTS; attempt++) {
         const res = await qb.fetchOne({
             tableName: "krl",
-            fields: ["version", "digest"],
+            fields: ["version", "digest", "updated_at"],
             where: {
                 conditions: "certificate_type = ?",
                 params: certificateType
@@ -179,16 +293,18 @@ export const getKrlVersion = async (env, certificateType, digest) => {
         }).execute();
         const current = KrlVersionRow.parse(res.results);
         if (current.digest === digest) {
-            return BigInt(current.version);
+            return { version: BigInt(current.version), generatedAt: parseTimestamp(current.updated_at) };
         }
-        // only update if the version has not been changed by another request
+        // only update if the version has not been changed by another request,
+        // recording the time to the second as that is all a KRL records
         const next = current.version + 1;
+        const generatedAt = new Date(Math.floor(Date.now() / 1000) * 1000);
         const updated = await qb.update({
             tableName: "krl",
             data: {
                 version: next,
                 digest: digest,
-                updated_at: (new Date).toISOString()
+                updated_at: generatedAt.toISOString()
             },
             where: {
                 conditions: "certificate_type = ? AND version = ?",
@@ -200,7 +316,7 @@ export const getKrlVersion = async (env, certificateType, digest) => {
             throw new Error("error during query");
         }
         if (updated.results !== undefined && updated.results.length > 0) {
-            return BigInt(next);
+            return { version: BigInt(next), generatedAt };
         }
     }
     throw new Error("unable to update KRL version due to concurrent updates");