Maintain a denied database about boulder HOT 11 CLOSED

Should have pasted in the full text:

Verification against the Denied List
In accordance with the CA/B Forum Baseline Requirements, the CA maintains an internal database of all previously revoked DV-SSL Certificates and previously rejected certificate requests due to suspected phishing or other fraudulent usage or concerns. The CA uses this information to identify subsequent suspicious certificate requests. DV-SSL applications that cannot pass this review will not be issued a DV-SSL Certificate. If the DV-SSL Certificate does not pass review, it will be added to a list of previously denied applications and kept for verification purposes of future DV-SSL Certificate applications. If a new request for a previously denied DV-SSL Certificate is made, the application is the application is rejected immediately by the CA, which notifies the ACME client of the rejection. The instance is added to the internal database of DV-SSL denied lists.

https://letsencrypt.org/ISRG-CPS-Draft-May-5-2015.pdf

from boulder.

Merged PR 185.

from boulder.

We should probably add a utility to append to this DB, at some point.

from boulder.

Filed at #198.

from boulder.

Fixed by #185, closing.

from boulder.

There are still code stubs around that imply that denied requests are populated within boulder itself (vs. via admin-revoke). I am including this in #262 .

from boulder.

Technically, according to the CPS we do need to populate the denied requests within Boulder itself, if anything hits the denied list:

If a new request for a previously denied DV-SSL Certificate is made, the application is the application is rejected immediately by the CA, which notifies the ACME client of the rejection. The instance is added to the internal database of DV-SSL denied lists.

The language is a bit broken, because it implies we need to add names to the DB that are already there.

@bdaehlie, where are we on the CPS? Would it be disruptive / time consuming to try and fix this in the CPS?

from boulder.

Assigned to me to resolve CPS issue.

from boulder.

Status on this? I'm digging around in DB stuff and want to make sure we're covered.

from boulder.

Moving to GA per email with @bdaehlie. We're going to fix it in the CPS, but not in the current round of edits.

from boulder.

This will be resolved in the CPS. No boulder fix needed.

from boulder.