{"action":"created","issue":{"url":"https://api.github.com/repos/coreos/etcd/issues/4034","labels_url":"https://api.github.com/repos/coreos/etcd/issues/4034/labels{/name}","comments_url":"https://api.github.com/repos/coreos/etcd/issues/4034/comments","events_url":"https://api.github.com/repos/coreos/etcd/issues/4034/events","html_url":"https://github.com/coreos/etcd/issues/4034","id":123342955,"number":4034,"title":"Support for managing revoked certs","user":{"login":"stensonb","id":933389,"avatar_url":"https://avatars.githubusercontent.com/u/933389?v=3","gravatar_id":"","url":"https://api.github.com/users/stensonb","html_url":"https://github.com/stensonb","followers_url":"https://api.github.com/users/stensonb/followers","following_url":"https://api.github.com/users/stensonb/following{/other_user}","gists_url":"https://api.github.com/users/stensonb/gists{/gist_id}","starred_url":"https://api.github.com/users/stensonb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stensonb/subscriptions","organizations_url":"https://api.github.com/users/stensonb/orgs","repos_url":"https://api.github.com/users/stensonb/repos","events_url":"https://api.github.com/users/stensonb/events{/privacy}","received_events_url":"https://api.github.com/users/stensonb/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2015-12-21T19:32:02Z","updated_at":"2016-01-21T18:25:48Z","closed_at":null,"body":"Authentication via x509 certs are great...until one of the certs is compromised, needs to be revoked, or is no longer required.\r\n\r\n[CRL](https://en.wikipedia.org/wiki/Revocation_list) offers a way to this by distributing a blacklist.\r\n[OCSP](https://en.wikipedia.org/wiki/Online_Certificate_Status_Protocol) offers a way to verify each request's authenticity cert against a service, denying validity for certs which have been \"revoked\".\r\n\r\nETCD should support either CRL, OCSP, or both to ensure that SSL keys can be guaranteed \"valid\", despite being signed with a common CA."},"comment":{"url":"https://api.github.com/repos/coreos/etcd/issues/comments/173664413","html_url":"https://github.com/coreos/etcd/issues/4034#issuecomment-173664413","issue_url":"https://api.github.com/repos/coreos/etcd/issues/4034","id":173664413,"user":{"login":"gtank","id":622063,"avatar_url":"https://avatars.githubusercontent.com/u/622063?v=3","gravatar_id":"","url":"https://api.github.com/users/gtank","html_url":"https://github.com/gtank","followers_url":"https://api.github.com/users/gtank/followers","following_url":"https://api.github.com/users/gtank/following{/other_user}","gists_url":"https://api.github.com/users/gtank/gists{/gist_id}","starred_url":"https://api.github.com/users/gtank/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gtank/subscriptions","organizations_url":"https://api.github.com/users/gtank/orgs","repos_url":"https://api.github.com/users/gtank/repos","events_url":"https://api.github.com/users/gtank/events{/privacy}","received_events_url":"https://api.github.com/users/gtank/received_events","type":"User","site_admin":false},"created_at":"2016-01-21T18:25:48Z","updated_at":"2016-01-21T18:25:48Z","body":"I think dependency on an OCSP server (or _being_ an OCSP server) is out of scope for etcd. However it would be completely reasonable for peers to check a CRL if the admin supplies one. Go provides functions for handling CRLs already, we will just need to build the logic around them."}}