Certificate Revocation List(CRL) support for HC Vault

[shub-est]

SOPS currently uses HTTP Client to connect with Vault, with support for TLS.

In case of Certificate Breach and Revocation, the old certificate could still be validated by the Vault HTTP Client.

In order to prevent exposure, can we add CRL support to SOPS?

We are happy to work on a PR for this

[felixfontein]

SOPS uses the HC Vault Go client library for talking to HC Vault. Did you check whether this library supports that?

[shub-est]

The HC Vault Go client library does not support CRL checking natively. It has no built-in mechanism to validate server certificates against a CRL.

The approach that we are considering is to configure the HTTP Client to support certificate validation. We will fetch the TLSClientConfig from the configured HTTP client and add an implementation of the VerifyPeerCertificate callback to check the cert against a CRL.

The CRL could be provided by the user using a new env var e.g. SOPS_HC_VAULT_CLIENT_CRL (similar to the existing SOPS_HC_VAULT_ALLOWLIST)"

[felixfontein]

I'm not sure whether we would want to maintain something like that in the SOPS codebase. I would suggest trying to get this into the HC Vault Go client library.

CC @getsops/maintainers - maybe other opinions on this?

[shub-est]

We are not sure if our contribution would be accepted there

We would be happy to design the implementation in such a way that it doesn't incur a lot of maintenance for SOPS

If you have a design that would achieve this in mind, please let us know

[shub-est]

Hi @felixfontein / maintainers,

Checking in on this issue. Do you think it would be possible to add the CRL functionality to SOPS?

Appreciate any feedback