Management Node Implement OCSP requiements to allow certificate revokation

[nikan-negaresh-informed]

---

Summary: Management Node — implement OCSP responder for certificate revocation

Type: Story
Component: Management Node
Labels: federation, pki, ocsp, certificate-revocation, rfc6960

---

Description

The Management Node must implement an RFC 6960-compliant OCSP Responder to support real-time certificate revocation checking across the federation. Federator nodes performing mTLS handshakes query the OCSP Responder to confirm peer certificate validity. The responder must reflect revocation state immediately, with cache eviction on revocation to prevent stale GOOD responses being served after a certificate is revoked.

---

Acceptance Criteria

• Management Node exposes an OCSP Responder endpoint (POST /ocsp) accepting DER-encoded OCSP requests
• Responses correctly return GOOD, REVOKED, or UNKNOWN status per queried certificate serial number
• Revocation status is sourced from Vault/OpenBao PKI engine in real time
• OCSP responses are signed by the Management Node's CA signing key
• Responses are cached; TTL aligns with nextUpdate interval (~1 hour)
• Cache entry is immediately evicted on certificate revocation — stale GOOD responses must not be served post-revocation
• Certificates issued by the Management Node include the AIA extension with the OCSP Responder URL
• Per-organisation intermediate CA serial numbers are correctly resolved (aligns with per-org intermediate CA story)
• Responder remains available under load; response latency is within a configurable SLA threshold

---

Technical Notes

• Bouncy Castle (bcpkix-jdk18on) for DER-encoded OCSP request parsing (OCSPReq) and response construction (BasicOCSPRespBuilder)
• OCSP response signing: use the intermediate CA key held in Vault; signing must not expose the private key outside Vault — use Vault's Transit engine or PKI sign endpoint
• Cache: in-memory keyed on certificate serial number + issuer hash; eviction hook must be called by the revocation path (organisation deregistration, manual revocation API)
• nextUpdate set to thisUpdate + 1 hour; configurable via management.ocsp.next-update-seconds
• AIA extension injection: update certificate issuance flow to include id-ad-ocsp pointing to the Management Node's public OCSP endpoint
• Per-org intermediate CA resolution: OCSP request includes issuer key hash — responder must identify the correct org PKI mount in Vault to query revocation state

---

Out of Scope

• OCSP stapling (consumed by Federator, not produced here)
• CRL generation
• Federator-side OCSP consumption (separate story)

---

Dependencies

• Vault/OpenBao PKI engine with revocation status queryable per org mount
• Per-organisation intermediate CA structure in place
• Management Node CA signing key accessible for response signing
• Federator OCSP story (consumer of this responder)

---

Definition of Done

• OCSP endpoint returns correct status for GOOD, REVOKED, and UNKNOWN certificates
• Immediate cache eviction on revocation confirmed — no stale GOOD response served post-revocation
• AIA extension present in newly issued certificates pointing to responder URL
• Per-org issuer resolution verified
• Bouncy Castle DER encode/decode round-trip tested
• PR reviewed and merged