diff --git a/sa/db-next/boulder_sa/20251002000000_AddRevokedSerialsIndex.sql b/sa/db-next/boulder_sa/20251002000000_AddRevokedSerialsIndex.sql deleted file mode 100644 index 44815cc4edf..00000000000 --- a/sa/db-next/boulder_sa/20251002000000_AddRevokedSerialsIndex.sql +++ /dev/null @@ -1,9 +0,0 @@ --- +migrate Up --- SQL in section 'Up' is executed when this migration is applied - -ALTER TABLE `revokedCertificates` ADD KEY `serial` (`serial`); - --- +migrate Down --- SQL section 'Down' is executed when this migration is rolled back - -ALTER TABLE `revokedCertificates` DROP KEY `serial`; diff --git a/sa/db-next/boulder_sa/20251021000000_AddRevokedSerialsIndex.sql b/sa/db-next/boulder_sa/20251021000000_AddRevokedSerialsIndex.sql new file mode 100644 index 00000000000..87ab4e3aa5c --- /dev/null +++ b/sa/db-next/boulder_sa/20251021000000_AddRevokedSerialsIndex.sql @@ -0,0 +1,12 @@ +-- +migrate Up +-- SQL in section 'Up' is executed when this migration is applied + +ALTER TABLE `revokedCertificates` REMOVE PARTITIONING; +ALTER TABLE `revokedCertificates` ADD UNIQUE INDEX `serial` (`serial`); + +-- +migrate Down +-- SQL section 'Down' is executed when this migration is rolled back + +ALTER TABLE `revokedCertificates` DROP UNIQUE INDEX `serial`; +ALTER TABLE `revokedCertificates` PARTITION BY RANGE(id) +(PARTITION p_start VALUES LESS THAN (MAXVALUE)); diff --git a/sa/sa.go b/sa/sa.go index 0db3b60adb3..9266d4031dc 100644 --- a/sa/sa.go +++ b/sa/sa.go @@ -806,6 +806,12 @@ func addRevokedCertificate(ctx context.Context, tx db.Executor, req *sapb.Revoke NotAfterHour: serial.Expires.Add(time.Hour).Truncate(time.Hour), }) if err != nil { + if db.IsDuplicate(err) { + // An attempted duplicate insert means that this certificate was already + // revoked. The RA has special logic for that case, so use the specific + // error for it. + return berrors.AlreadyRevokedError("certificate already revoked") + } return fmt.Errorf("inserting revoked certificate row: %w", err) }