Certificates: revocation status and an expired filter (#143)
Two follow-ups from Stanley after v0.24.12.
Revocation. Certificates that had been revoked were showing as "Valid",
because revocation is not derivable from dates — a revoked certificate
keeps a perfectly good invalid-after. RouterOS does expose it, but not the
way the other flags work, and the difference was only established by
creating a CA on the test switch, signing a certificate, revoking it and
capturing the payload either side:
before trusted=false crl=false issued=true (no revoked field at all)
after trusted=false crl=false revoked=true (and issued has vanished)
So the field is absent rather than false when a certificate is healthy,
and it arrives twice — once as a timestamp, once as a boolean — which our
client collapses to the last occurrence. A revoked === 'true' test would
work only while RouterOS keeps that order, and would fail towards "valid"
if it ever swapped them. readRevocation() considers every occurrence
instead, and keeps the timestamp, which is the thing an operator wants
when they find a revoked certificate still installed.
The same capture showed issued disappearing on revocation, so the column
added for it was dropped again before it shipped rather than storing a
value that silently goes wrong.
Revoked certificates deliberately do not alert. Someone revoked it on
purpose, and some cannot be deleted while a CA still references them, so
alerting would mean a daily email about a decision already made. They are
corrected in the list, not escalated.
Filtering. Stanley has an expired certificate RouterOS will not let him
delete while a CA references it through a CRL, so it sits permanently red.
"Don't display expired certificates" was the other reading of the request
and is the wrong default — that is the exact thing this feature exists to
surface. Instead: a Hide expired toggle that only appears when there is
something to hide, remembered per view, with the hidden count still shown.
Also moved the "N need attention" count to the server. It was a second
copy of needsAttention() in the browser, and adding a state was precisely
the change that would have made the page and the alerts disagree.
Verified end to end on 2GT-NW-MIKROTIK10G-TEST: a certificate expiring in
a year, revoked, collected and stored as revoked with its timestamp, and
excluded from attentionCount. Test certificates and the CA removed
afterwards; the switch and the database are back as they were.
36 tests across the two utils, 10 of them against verbatim hardware
captures. Full preflight green.
Container image: ghcr.io/2gt-media-group-llc/mikrotik-manager:0.24.13-beta
Documentation: https://2gt-media-group-llc.github.io/mikrotik-manager/