{"action":"created","comment":{"url":"https://api.github.com/repos/ravendb/ravendb/pulls/comments/144838619","pull_request_review_id":69550553,"id":144838619,"diff_hunk":"@@ -258,52 +298,106 @@ private static X509Certificate2 GetRootCertificate(X509Chain chain)\n             var feature = HttpContext.Features.Get<IHttpAuthenticationFeature>() as RavenServer.AuthenticateConnection;\n             var clientCert = feature?.Certificate;\n \n-            if (clientCert != null && clientCert.Thumbprint.Equals(thumbprint))\n-                throw new InvalidOperationException($\"Cannot delete {clientCert.SubjectName.Name} becuase it's the current client certificate being used\");\n-\n             using (ServerStore.ContextPool.AllocateOperationContext(out TransactionOperationContext ctx))\n             {\n+                if (clientCert != null && clientCert.Thumbprint.Equals(thumbprint))\n+                {\n+                    var clientCertDef = ReadCertificateFromCluster(ctx, Constants.Certificates.Prefix + thumbprint);\n+                    throw new InvalidOperationException($\"Cannot delete {clientCertDef?.Name} becuase it's the current client certificate being used\");\n+                }\n+\n+                if (clientCert != null && Server.ClusterCertificateHolder.Certificate.Thumbprint.Equals(thumbprint))\n+                {\n+                    var serverCertDef = ReadCertificateFromCluster(ctx, Constants.Certificates.Prefix + thumbprint);\n+                    throw new InvalidOperationException($\"Cannot delete {serverCertDef?.Name} becuase it's the current server certificate being used\");\n+                }\n+\n                 var key = Constants.Certificates.Prefix + thumbprint;\n-                using (ctx.OpenWriteTransaction())\n+                var definition = ReadCertificateFromCluster(ctx, key);\n+                if (definition.SecurityClearance == SecurityClearance.ClusterAdmin || definition.SecurityClearance == SecurityClearance.ClusterNode \n+                    && IsClusterAdmin() == false)\n                 {\n-                    var certificate = ServerStore.Cluster.Read(ctx, key);\n+                    var clientCertDef = ReadCertificateFromCluster(ctx, Constants.Certificates.Prefix + clientCert?.Thumbprint);\n+                    throw new InvalidOperationException(\n+                        $\"Cannot delete the certificate '{definition.Name}' with '{definition.SecurityClearance}' security clearance because the current client certificate being used has a lower clearance: {clientCertDef.SecurityClearance}\");\n+                }\n \n-                    var definition = JsonDeserializationServer.CertificateDefinition(certificate);\n+                if (string.IsNullOrEmpty(definition.CollectionPrimaryKey) == false)\n+                    throw new InvalidOperationException(\n+                        $\"Cannot delete the certificate '{definition.Name}' with thumbprint '{definition.Thumbprint}'. You need to delete the primary certificate of the collection: {definition.CollectionPrimaryKey}\");\n \n-                    if (definition?.SecurityClearance == SecurityClearance.ClusterAdmin && IsClusterAdmin() == false)\n-                        throw new InvalidOperationException(\n-                            $\"Cannot delete the certificate '{definition?.Name}' with 'Cluster Admin' security clearance because the current client certificate being used has a lower clearance: {clientCert}\");\n+                await DeleteInternal(key);\n \n-                    ServerStore.Cluster.DeleteLocalState(ctx, key);\n+                foreach (var secondaryKey in definition.CollectionSecondaryKeys) // If it's a collection, also delete the secondary certificates","path":"src/Raven.Server/Web/Authentication/AdminCertificatesHandler.cs","position":198,"original_position":198,"commit_id":"0b525872bd97f8c88438b1c1cfa72b8a93fad94c","original_commit_id":"0b525872bd97f8c88438b1c1cfa72b8a93fad94c","user":{"login":"iftahbe","id":12386147,"avatar_url":"https://avatars0.githubusercontent.com/u/12386147?v=4","gravatar_id":"","url":"https://api.github.com/users/iftahbe","html_url":"https://github.com/iftahbe","followers_url":"https://api.github.com/users/iftahbe/followers","following_url":"https://api.github.com/users/iftahbe/following{/other_user}","gists_url":"https://api.github.com/users/iftahbe/gists{/gist_id}","starred_url":"https://api.github.com/users/iftahbe/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/iftahbe/subscriptions","organizations_url":"https://api.github.com/users/iftahbe/orgs","repos_url":"https://api.github.com/users/iftahbe/repos","events_url":"https://api.github.com/users/iftahbe/events{/privacy}","received_events_url":"https://api.github.com/users/iftahbe/received_events","type":"User","site_admin":false},"body":"yes","created_at":"2017-10-16T12:58:19Z","updated_at":"2017-10-16T12:58:19Z","html_url":"https://github.com/ravendb/ravendb/pull/3978#discussion_r144838619","pull_request_url":"https://api.github.com/repos/ravendb/ravendb/pulls/3978","author_association":"MEMBER","_links":{"self":{"href":"https://api.github.com/repos/ravendb/ravendb/pulls/comments/144838619"},"html":{"href":"https://github.com/ravendb/ravendb/pull/3978#discussion_r144838619"},"pull_request":{"href":"https://api.github.com/repos/ravendb/ravendb/pulls/3978"}},"in_reply_to_id":144798022},"pull_request":{"url":"https://api.github.com/repos/ravendb/ravendb/pulls/3978","id":146731977,"html_url":"https://github.com/ravendb/ravendb/pull/3978","diff_url":"https://github.com/ravendb/ravendb/pull/3978.diff","patch_url":"https://github.com/ravendb/ravendb/pull/3978.patch","issue_url":"https://api.github.com/repos/ravendb/ravendb/issues/3978","number":3978,"state":"closed","locked":false,"title":"RavenDB-8861 Allow getting certificates from the cluster","user":{"login":"iftahbe","id":12386147,"avatar_url":"https://avatars0.githubusercontent.com/u/12386147?v=4","gravatar_id":"","url":"https://api.github.com/users/iftahbe","html_url":"https://github.com/iftahbe","followers_url":"https://api.github.com/users/iftahbe/followers","following_url":"https://api.github.com/users/iftahbe/following{/other_user}","gists_url":"https://api.github.com/users/iftahbe/gists{/gist_id}","starred_url":"https://api.github.com/users/iftahbe/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/iftahbe/subscriptions","organizations_url":"https://api.github.com/users/iftahbe/orgs","repos_url":"https://api.github.com/users/iftahbe/repos","events_url":"https://api.github.com/users/iftahbe/events{/privacy}","received_events_url":"https://api.github.com/users/iftahbe/received_events","type":"User","site_admin":false},"body":"- RavenDB-8973 Fix NRE in RachisAdminHandler\r\n- Add ClusterNode SecurityClearance for server certificates\r\n- Allow to export ClusterNode certificates to .pfx file\r\n- Fix bug, register server's own certificate in cluster\r\n- Fix paths in cluster scripts\r\n- Better errors in certificates handlers","created_at":"2017-10-16T09:10:23Z","updated_at":"2017-10-16T12:58:19Z","closed_at":"2017-10-16T09:41:32Z","merged_at":"2017-10-16T09:41:32Z","merge_commit_sha":"4b2c605ffa3af88a35ae66b828f5612414a8e3f6","assignee":null,"assignees":[],"requested_reviewers":[],"milestone":null,"commits_url":"https://api.github.com/repos/ravendb/ravendb/pulls/3978/commits","review_comments_url":"https://api.github.com/repos/ravendb/ravendb/pulls/3978/comments","review_comment_url":"https://api.github.com/repos/ravendb/ravendb/pulls/comments{/number}","comments_url":"https://api.github.com/repos/ravendb/ravendb/issues/3978/comments","statuses_url":"https://api.github.com/repos/ravendb/ravendb/statuses/0b525872bd97f8c88438b1c1cfa72b8a93fad94c","head":{"label":"iftahbe:RavenDB-8861-cert-collection","ref":"RavenDB-8861-cert-collection","sha":"0b525872bd97f8c88438b1c1cfa72b8a93fad94c","user":{"login":"iftahbe","id":12386147,"avatar_url":"https://avatars0.githubusercontent.com/u/12386147?v=4","gravatar_id":"","url":"https://api.github.com/users/iftahbe","html_url":"https://github.com/iftahbe","followers_url":"https://api.github.com/users/iftahbe/followers","following_url":"https://api.github.com/users/iftahbe/following{/other_user}","gists_url":"https://api.github.com/users/iftahbe/gists{/gist_id}","starred_url":"https://api.github.com/users/iftahbe/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/iftahbe/subscriptions","organizations_url":"https://api.github.com/users/iftahbe/orgs","repos_url":"https://api.github.com/users/iftahbe/repos","events_url":"https://api.github.com/users/iftahbe/events{/privacy}","received_events_url":"https://api.github.com/users/iftahbe/received_events","type":"User","site_admin":false},"repo":{"id":53836398,"name":"ravendb","full_name":"iftahbe/ravendb","owner":{"login":"iftahbe","id":12386147,"avatar_url":"https://avatars0.githubusercontent.com/u/12386147?v=4","gravatar_id":"","url":"https://api.github.com/users/iftahbe","html_url":"https://github.com/iftahbe","followers_url":"https://api.github.com/users/iftahbe/followers","following_url":"https://api.github.com/users/iftahbe/following{/other_user}","gists_url":"https://api.github.com/users/iftahbe/gists{/gist_id}","starred_url":"https://api.github.com/users/iftahbe/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/iftahbe/subscriptions","organizations_url":"https://api.github.com/users/iftahbe/orgs","repos_url":"https://api.github.com/users/iftahbe/repos","events_url":"https://api.github.com/users/iftahbe/events{/privacy}","received_events_url":"https://api.github.com/users/iftahbe/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/iftahbe/ravendb","description":"A linq enabled document database for .NET","fork":true,"url":"https://api.github.com/repos/iftahbe/ravendb","forks_url":"https://api.github.com/repos/iftahbe/ravendb/forks","keys_url":"https://api.github.com/repos/iftahbe/ravendb/keys{/key_id}","collaborators_url":"https://api.github.com/repos/iftahbe/ravendb/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/iftahbe/ravendb/teams","hooks_url":"https://api.github.com/repos/iftahbe/ravendb/hooks","issue_events_url":"https://api.github.com/repos/iftahbe/ravendb/issues/events{/number}","events_url":"https://api.github.com/repos/iftahbe/ravendb/events","assignees_url":"https://api.github.com/repos/iftahbe/ravendb/assignees{/user}","branches_url":"https://api.github.com/repos/iftahbe/ravendb/branches{/branch}","tags_url":"https://api.github.com/repos/iftahbe/ravendb/tags","blobs_url":"https://api.github.com/repos/iftahbe/ravendb/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/iftahbe/ravendb/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/iftahbe/ravendb/git/refs{/sha}","trees_url":"https://api.github.com/repos/iftahbe/ravendb/git/trees{/sha}","statuses_url":"https://api.github.com/repos/iftahbe/ravendb/statuses/{sha}","languages_url":"https://api.github.com/repos/iftahbe/ravendb/languages","stargazers_url":"https://api.github.com/repos/iftahbe/ravendb/stargazers","contributors_url":"https://api.github.com/repos/iftahbe/ravendb/contributors","subscribers_url":"https://api.github.com/repos/iftahbe/ravendb/subscribers","subscription_url":"https://api.github.com/repos/iftahbe/ravendb/subscription","commits_url":"https://api.github.com/repos/iftahbe/ravendb/commits{/sha}","git_commits_url":"https://api.github.com/repos/iftahbe/ravendb/git/commits{/sha}","comments_url":"https://api.github.com/repos/iftahbe/ravendb/comments{/number}","issue_comment_url":"https://api.github.com/repos/iftahbe/ravendb/issues/comments{/number}","contents_url":"https://api.github.com/repos/iftahbe/ravendb/contents/{+path}","compare_url":"https://api.github.com/repos/iftahbe/ravendb/compare/{base}...{head}","merges_url":"https://api.github.com/repos/iftahbe/ravendb/merges","archive_url":"https://api.github.com/repos/iftahbe/ravendb/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/iftahbe/ravendb/downloads","issues_url":"https://api.github.com/repos/iftahbe/ravendb/issues{/number}","pulls_url":"https://api.github.com/repos/iftahbe/ravendb/pulls{/number}","milestones_url":"https://api.github.com/repos/iftahbe/ravendb/milestones{/number}","notifications_url":"https://api.github.com/repos/iftahbe/ravendb/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/iftahbe/ravendb/labels{/name}","releases_url":"https://api.github.com/repos/iftahbe/ravendb/releases{/id}","deployments_url":"https://api.github.com/repos/iftahbe/ravendb/deployments","created_at":"2016-03-14T07:41:28Z","updated_at":"2016-03-14T07:41:45Z","pushed_at":"2017-10-16T12:45:23Z","git_url":"git://github.com/iftahbe/ravendb.git","ssh_url":"git@github.com:iftahbe/ravendb.git","clone_url":"https://github.com/iftahbe/ravendb.git","svn_url":"https://github.com/iftahbe/ravendb","homepage":"http://ayende.com/Blog/","size":404197,"stargazers_count":0,"watchers_count":0,"language":"C#","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"v4.0"}},"base":{"label":"ravendb:v4.0","ref":"v4.0","sha":"4a4e8319cb07d6da388a445a3da6779d17a9ae57","user":{"login":"ravendb","id":213792,"avatar_url":"https://avatars0.githubusercontent.com/u/213792?v=4","gravatar_id":"","url":"https://api.github.com/users/ravendb","html_url":"https://github.com/ravendb","followers_url":"https://api.github.com/users/ravendb/followers","following_url":"https://api.github.com/users/ravendb/following{/other_user}","gists_url":"https://api.github.com/users/ravendb/gists{/gist_id}","starred_url":"https://api.github.com/users/ravendb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ravendb/subscriptions","organizations_url":"https://api.github.com/users/ravendb/orgs","repos_url":"https://api.github.com/users/ravendb/repos","events_url":"https://api.github.com/users/ravendb/events{/privacy}","received_events_url":"https://api.github.com/users/ravendb/received_events","type":"Organization","site_admin":false},"repo":{"id":542714,"name":"ravendb","full_name":"ravendb/ravendb","owner":{"login":"ravendb","id":213792,"avatar_url":"https://avatars0.githubusercontent.com/u/213792?v=4","gravatar_id":"","url":"https://api.github.com/users/ravendb","html_url":"https://github.com/ravendb","followers_url":"https://api.github.com/users/ravendb/followers","following_url":"https://api.github.com/users/ravendb/following{/other_user}","gists_url":"https://api.github.com/users/ravendb/gists{/gist_id}","starred_url":"https://api.github.com/users/ravendb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ravendb/subscriptions","organizations_url":"https://api.github.com/users/ravendb/orgs","repos_url":"https://api.github.com/users/ravendb/repos","events_url":"https://api.github.com/users/ravendb/events{/privacy}","received_events_url":"https://api.github.com/users/ravendb/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/ravendb/ravendb","description":"ACID NoSQL Document Database","fork":false,"url":"https://api.github.com/repos/ravendb/ravendb","forks_url":"https://api.github.com/repos/ravendb/ravendb/forks","keys_url":"https://api.github.com/repos/ravendb/ravendb/keys{/key_id}","collaborators_url":"https://api.github.com/repos/ravendb/ravendb/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/ravendb/ravendb/teams","hooks_url":"https://api.github.com/repos/ravendb/ravendb/hooks","issue_events_url":"https://api.github.com/repos/ravendb/ravendb/issues/events{/number}","events_url":"https://api.github.com/repos/ravendb/ravendb/events","assignees_url":"https://api.github.com/repos/ravendb/ravendb/assignees{/user}","branches_url":"https://api.github.com/repos/ravendb/ravendb/branches{/branch}","tags_url":"https://api.github.com/repos/ravendb/ravendb/tags","blobs_url":"https://api.github.com/repos/ravendb/ravendb/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/ravendb/ravendb/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/ravendb/ravendb/git/refs{/sha}","trees_url":"https://api.github.com/repos/ravendb/ravendb/git/trees{/sha}","statuses_url":"https://api.github.com/repos/ravendb/ravendb/statuses/{sha}","languages_url":"https://api.github.com/repos/ravendb/ravendb/languages","stargazers_url":"https://api.github.com/repos/ravendb/ravendb/stargazers","contributors_url":"https://api.github.com/repos/ravendb/ravendb/contributors","subscribers_url":"https://api.github.com/repos/ravendb/ravendb/subscribers","subscription_url":"https://api.github.com/repos/ravendb/ravendb/subscription","commits_url":"https://api.github.com/repos/ravendb/ravendb/commits{/sha}","git_commits_url":"https://api.github.com/repos/ravendb/ravendb/git/commits{/sha}","comments_url":"https://api.github.com/repos/ravendb/ravendb/comments{/number}","issue_comment_url":"https://api.github.com/repos/ravendb/ravendb/issues/comments{/number}","contents_url":"https://api.github.com/repos/ravendb/ravendb/contents/{+path}","compare_url":"https://api.github.com/repos/ravendb/ravendb/compare/{base}...{head}","merges_url":"https://api.github.com/repos/ravendb/ravendb/merges","archive_url":"https://api.github.com/repos/ravendb/ravendb/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/ravendb/ravendb/downloads","issues_url":"https://api.github.com/repos/ravendb/ravendb/issues{/number}","pulls_url":"https://api.github.com/repos/ravendb/ravendb/pulls{/number}","milestones_url":"https://api.github.com/repos/ravendb/ravendb/milestones{/number}","notifications_url":"https://api.github.com/repos/ravendb/ravendb/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/ravendb/ravendb/labels{/name}","releases_url":"https://api.github.com/repos/ravendb/ravendb/releases{/id}","deployments_url":"https://api.github.com/repos/ravendb/ravendb/deployments","created_at":"2010-03-02T11:05:30Z","updated_at":"2017-10-16T09:08:54Z","pushed_at":"2017-10-16T12:55:50Z","git_url":"git://github.com/ravendb/ravendb.git","ssh_url":"git@github.com:ravendb/ravendb.git","clone_url":"https://github.com/ravendb/ravendb.git","svn_url":"https://github.com/ravendb/ravendb","homepage":"http://ravendb.net","size":415779,"stargazers_count":1750,"watchers_count":1750,"language":"C#","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":671,"mirror_url":null,"open_issues_count":1,"forks":671,"open_issues":1,"watchers":1750,"default_branch":"v4.0"}},"_links":{"self":{"href":"https://api.github.com/repos/ravendb/ravendb/pulls/3978"},"html":{"href":"https://github.com/ravendb/ravendb/pull/3978"},"issue":{"href":"https://api.github.com/repos/ravendb/ravendb/issues/3978"},"comments":{"href":"https://api.github.com/repos/ravendb/ravendb/issues/3978/comments"},"review_comments":{"href":"https://api.github.com/repos/ravendb/ravendb/pulls/3978/comments"},"review_comment":{"href":"https://api.github.com/repos/ravendb/ravendb/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/ravendb/ravendb/pulls/3978/commits"},"statuses":{"href":"https://api.github.com/repos/ravendb/ravendb/statuses/0b525872bd97f8c88438b1c1cfa72b8a93fad94c"}},"author_association":"MEMBER"}}
{"actor":{"display_login":"iftahbe"}}