Add experimental flag to skip oidevid rotation (#47)

openconfig · Jul 25, 2024 · 560ec35 · 560ec35
1 parent 0b7d03c
commit 560ec35
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/service/biz/enrollz_biz.go b/service/biz/enrollz_biz.go
@@ -117,6 +117,8 @@ type EnrollControlCardReq struct {
 	CertVerificationOpts x509.VerifyOptions
 	// SSL profile ID to which newly-issued Owner IDevID cert should be applied.
 	SSLProfileID string
+	// Experimental flag used for lab testing only. Skips oIDevID rotation.
+	SkipOidevidRotate bool
 }
 
 // validateEnrollControlCardReq verifies that EnrollControlCardReq request is valid.
@@ -217,6 +219,9 @@ func EnrollControlCard(ctx context.Context, req *EnrollControlCardReq) error {
 		OidevidCert:          issueOwnerIDevIDCertResp.OwnerIDevIDCertPem,
 		SslProfileId:         req.SSLProfileID,
 	}
+	if req.SkipOidevidRotate {
+		rotateOIakCertReq.OidevidCert = ""
+	}
 	rotateOIakCertResp, err := req.Deps.RotateOIakCert(ctx, rotateOIakCertReq)
 	if err != nil {
 		err = fmt.Errorf("failed to rotate oIAK and oIDevID certs from the device with req=%s: %w",