Couple of comments on the CRL Branch

Bryan Kearney bkearney at redhat.com
Fri Jul 2 17:16:56 UTC 2010


- First time I have seen a Dto object in the code base. What caused us 
to need it?
- Who calls the ctor on CertificateRevocationListTask? How does the 
parameters get set?
- Reading in the entire CRL into memory scares me :) If we assume a 
serial number is a long of average length stored as a string, then it is 
10 bytes. Add another 18 bytes for the time stamp as a string, and then 
you get 28 bytes per entry. A million entitlements would get us roughly 
a 26 meg file. Is there a way to stream this? Perhaps read in each 
record from the CRL and the process it into the new file?
- Related to this, lets turn down the logging :)
- The logic for deleting the old certificates is to delete those that 
expired yesterday certs. Are there any rules about how long a cert needs 
to be in a CRL?
- Does the CRL need to be signed?
- Have we tried loading the CRL into apache or an ocspd daemon to see it 
will work?

-- bk




More information about the candlepin mailing list