Certificate revoke with hold and unrevoke with removeFromURL

[syisunny]

Hello,
on ejbca 8.2.0.1, I find that there is a change for the revoke api in revokeCert in EndEntityManagementSessionBean.
I create a certificate and call this api revokeCert with reason REVOCATION_REASON_CERTIFICATEHOLD. The call successed.
15:30:13,271 INFO [org.cesecore.audit.impl.log4j.Log4jDevice] (default task-21) 2024-02-08 15:30:13+00:00;CERT_REVOKED;SUCCESS;CERTIFICATE;CORE;ejbca;1788025220;653E063325F82ED7124FDDE14FD4765A1683D355;Yqb8SrZ8AKsb1B_Generic MO Client 1m;msg=Invalidity date for revoked certificate has been changed, for username 'Yqb8SrZ8AKsb1B_Generic MO Client 1m', fp=1483e26b8c7bfb69a4b3082ab117224656cd9eeb, revocationReason=6, subjectDN 'CN=Yqb8SrZ8AKsb1B,OU=TEST1-OU,O=TEST1-O,DC=TEST-DC', issuerDN 'CN=Generic Operation SubCA1,OU=QA4,O=TKM,C=FR', serialNo=653E063325F82ED7124FDDE14FD4765A1683D355.

then i call this revokeCert API again with reason REVOCATION_REASON_REMOVEFROMCRL, the call successed. from the log, i could see
15:30:13,377 INFO [org.ejbca.core.ejb.ca.revoke.RevocationSessionBean] (default task-21) Republished unrevoked cert, reason: 8.`

but from the EJBCA Admin GUI, it is still on hold

before with ejbca 7.11, the certificate became unrevoked after the call of removeFromCRL.

what do you think? from the release note, i didn't find the change about this revoke behavior.

Best regards,
Yi

[syisunny]

Hello,
I have done more tests and checked the sourcecode. it seems a bug when an invalidity date is provided.
If I set the invalidity date as null in my ejb call, the removefromCRL request works perfectly.
from my understanding of the sourcecode, there is an issue in CertificateStoreSessionBean.java for the function:
public boolean setRevokeStatusNoAuth(AuthenticationToken admin, BaseCertificateData certificateData, Date revokeDate, Date invalidityDate, int reason) throws CertificateRevokeException

There is a complex branch if as below, if the certificate is on hold and I call it again with removefromCRL, it is supposed to enter into the condition I highlighted. but if the invalidity date is not null, it enters into a condition before while the certificate is still kept as revoked with reason Hold.

could you please have a look? @primetomas

Thank you very much!

Best regards,
Yi

[primetomas]

This does look like a bug, just as you mention. Introduced with a new feature in 7.12.0.

[primetomas]

@syisunny can you do a "create issue from discussion" on this one, and we will fix it for the next release.
Thanks for the good analysis.

[primetomas]

Internal note: caused by ECA-10974 and specifically ECA-11255

[syisunny]

done

[primetomas]

Additional note. InvalidityDate is not logical to use for unrevocation. invalidityDate according to RFC5280 is to set a date when a key compromise or similar happened. It has no function for non revoked certificates. So just use null for unrevocation.

[primetomas]

Thanks.
#505