Signer Delete Interface (signerCertificate)

[gregsons]

Your Question

• Source File: https://ec.europa.eu/health/sites/health/files/ehealth/docs/digital-green-certificates_v2_en.pdf
• Line(s): 6.4.2 Parameters
• Question: Why SHA256-fingerprint of a certificate has been moved from header to body in current implementation of signerCertificate endpoint? DELETE operation shouldn't have any payload data in the body to be compliant with HTTP standard. If it's not possible to revoke changes, would it be possible for deleting certificates to:

1. Add PUT operation for signerCertificate endpoint or
2. Add POST/PUT operation for new endpoint

We're currently using ESB WSO2 for forwarding requests to Gateway which doesn't give possibility to forward data in body for DELETE operation. It can be configured only for GET:
https://docs.wso2.com/display/EI650/HTTP+Transport+Properties#HTTPTransportProperties-NO_ENTITY_BODY

[f11h]

Hi @gregsons ,

a payload in a DELETE-Request is not violating any RFC in any form.

The way of deleting/ revoking certificates was changed because it was required to also sign delete requests with your uploader certificate. (Please mind: It is not only moving the hash from header to body).
The delete/ revoke endpoint works exactly like the upload endpoint. (regarding payload and payload validation).

As I can see in the linked documentation this property only affects GET requests. Have you tried sending a delete message via this proxy?

[gregsons]

Hi @f11h ,
Yes, we've tried and ESB WSO2 by default deletes any payload in body part for DELETE requests. For version we're using (6.5.0), the defualt behavior can be changed to not deleting body part, but only for GET requests.
That's why proposal for [1] or [2] in the first post.

[f11h]

Hi @gregsons ,

I've created a PR to adress your issue. This PR introduces an alias for accessing the delete endpoint.
This can be used with

POST /signerCertificate/delete

Payload: Signed CMS Message

[gregsons]

@f11h thank you, would it be possible to add support for /signerCertificate/delete also in dgc-lib?

[f11h]

Yes, I will think about it how to integrate it the best way

[f11h]

I've created an issue in dgc-lib project to introduce the feature: eu-digital-green-certificates/dgc-lib#28

[gregsons]

Thank you!