crl

// The certificate revocation list (CRL) of a certification authority, read at its distribution point: the
// hours left before it expires, when it was published, how many certificates it revokes and who issued it.
// Once its next update has passed, clients refuse every certificate of the authority whose revocation they
// check. A delta CRL is read the same way, at its own address.
// One GET to the address set, nothing else sent: the list is public, served for any client to fetch. Its
// signature is not checked: the collector reads what the list says of itself.
need('protocol:http');

$url = variable('crl:url', 'text', array(
    'label' => 'CRL address',
    'help'  => 'The full address of the CRL, as the CRL Distribution Points of the certificates give it, for instance http://pki.example/CertEnroll/Example-CA.crl, or Example-CA+.crl for its delta CRL.',
));

output('hours-left', 'number', array('label' => 'Before the CRL expires', 'unit' => 'h'));
output('published', 'text', array('label' => 'Published'));
output('entries', 'number', array('label' => 'Revoked certificates'));
output('issuer', 'text', array('label' => 'Issuer'));

watch.below('expiring', 'CRL expiring', 'hours-left', array('warning' => 8, 'critical' => 4));
watch.below('expired', 'CRL expired', 'hours-left', array('critical' => 0));
watch.expect('issuer', 'Unexpected issuer', 'issuer', array(
    'help'    => 'Raises when the CRL is issued by another authority than those given, for instance an address that serves the list of an old authority.',
    'enabled' => false,
));

$answer = http.get($url);
if ($answer['status'] == 404) {
    fail('misconfigured', 'No CRL at this address, code 404', $url);
}
if ($answer['status'] != 200) {
    fail('unreachable', 'The distribution point answers code ' . $answer['status'], $url);
}

// The body is kept byte for byte: a list in DER, as a Windows authority publishes it, reads as one in PEM.
$crl = x509.crl($answer['body']);
if ($crl['next_update'] == '') {
    fail('misconfigured', 'The CRL gives no next update', 'Nothing says when it expires: an authority always writes it.');
}

value('hours-left', number.round(($crl['next_update'] - time.now()) / 3600, 1));
value('published', time.format($crl['this_update'], 'rfc3339'));
value('entries', $crl['entries']);
value('issuer', $crl['issuer']);