On Fri, May 25, 2012 at 04:02:40PM -0300, James Bowes wrote:
<snip>
> >If we don't hit one of those cases, like if we've
added a new product,
> >we simply mark the cert as dirty. That dirty cert is still valid until
> >the new regen is done, but why not just keep it valid for as long as
> >the newly regenerated version? that is, can we reuse the cert serial on
> >the new cert, keeping the old version still valid, and reducing both the
> >clutter in our CRL and the rate at which we consume cert serials? I
> >think that would work.
>
> Having multiple certificates out in the wild with different contents
> but the same serial, all still valid, seems strange and like a
> probable source of future confusion, and perhaps an issue for our
> database. Each unique cert seems like it should probably have it's
> own serial to me.
As far as the database goes, i think we'd be ok with just storing the
newest copy under that serial, I guess I'm ok with creating the new cert
with a new Id and revoking the old at the same time, but it would be
cool to cut down on additions to the CRL.
Forget this part. If we keep the same serial, that will most definately
break clients! silly me.
>
> If CRL clutter is a current known problem then it's worth
> considering, but otherwise I'd propose we leave that for another day
> and solve it if the issue arises.
>
It's not a problem, but it is a concern. Every item we add to that list
is more memory some hash table on the cdn takes up. I'd hate to see that
thing start swapping because the file we build it too large.
> Cheers,
>
> Devan
-James
_______________________________________________
candlepin mailing list
candlepin(a)lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/candlepin
-James