Adjust incosistent pki log messages

[yhabteab]

Checked all the error codes and couldn't find any others that could be raised,
even though the crt was issued by CA, apart from the revoked CRTs.

resolves #8682

[Al2Klimov]

Write a test protocol.

[yhabteab]

Before:
See #8682 (comment)

After:

[2021-08-09 15:26:16 +0200] information/ApiListener: New client connection for identity 'satellite' from [::ffff:127.0.0.1]:55429 (certificate validation failed: code 23: certificate revoked)
[2021-08-09 15:26:16 +0200] information/JsonRpcConnection: Received certificate request for CN 'satellite' no longer trusted: certificate revoked (code 23)
[2021-08-09 15:26:16 +0200] information/JsonRpcConnection: Certificate request for CN 'satellite' is pending. Waiting for approval.
[2021-08-09 15:26:16 +0200] warning/JsonRpcConnection: API client disconnected for identity 'satellite'

[Al2Klimov]

[2021-08-09 15:26:16 +0200] information/ApiListener: New client connection for identity 'satellite' from [::ffff:127.0.0.1]:55429 (certificate validation failed: code 23: certificate revoked)

And the other case?

[yhabteab]

[2021-08-09 15:26:16 +0200] information/ApiListener: New client connection for identity 'satellite' from [::ffff:127.0.0.1]:55429 (certificate validation failed: code 23: certificate revoked)

And the other case?

Which other case?

[yhabteab]

X509_V_ERR_CRL_HAS_EXPIRED ?

[Al2Klimov]

Well, you've introduced an if with an else branch – two cases. One's already covered by #8965 (comment) – one not.

[yhabteab]

[2021-08-09 18:25:33 +0200] information/ApiListener: New client connection for identity 'satellite' from [::ffff:127.0.0.1]:56671 (certificate validation failed: code 23: certificate revoked)
[2021-08-09 18:25:33 +0200] information/JsonRpcConnection: Received certificate request for CN 'satellite' not signed by our CA: CRL has expired (code 12)
[2021-08-09 18:25:33 +0200] information/JsonRpcConnection: Certificate request for CN 'satellite' is pending. Waiting for approval.
[2021-08-09 18:25:33 +0200] warning/JsonRpcConnection: API client disconnected for identity 'satellite'

[yhabteab]

Actually, CRL has expired also falls under the no longer trusted flavor, doesn't it?

[julianbrost]

My intention was not to give suggestions for the individual cases. What I wanted to say was to not attempt using different wording depending on the error cause but instead remove that if altogether and use a single message in all cases.

I just didn't want to give exact wording. You also have to ensure that it fits the rest of the message, for example "Received certificate request for CN 'foo' verification failed: [...]" sounds broken.

[julianbrost]

Now the message is "Received certificate request for CN 'something' couldn't be verified: some error message", it should rather be "which couldn't be verified" to be correct.

[cla-bot]

Thank you for your pull request. Before we can look at it, you'll need to sign a Contributor License Agreement (CLA).

Please follow instructions at https://icinga.com/company/contributor-agreement to sign the CLA.

After that, please reply here with a comment and we'll verify.

Contributors that have not signed yet: @yhabteab

• If you've already signed a CLA, it's possible we don't have your GitHub username or you're using a different email address. Please contact us if you think this is the case.

• If you signed the CLA as a corporation, your GitHub username may not have been submitted to us. Please reach out to the responsible person in your organization.

[yhabteab]

it should rather be "which couldn't be verified" to be correct.

Actually, I don't see any difference, but I have changed it the way you requested.

[julianbrost]

it should rather be "which couldn't be verified" to be correct.

Actually, I don't see any difference, but I have changed it the way you requested.

On second thought, both versions are fine. Without "which", you have the read "received" as an adjective and not as the verb of the sentence (which I didn't in the first place).

[Al2Klimov]

@cla-bot check

[cla-bot]

Thank you for your pull request. Before we can look at it, you'll need to sign a Contributor License Agreement (CLA).

Please follow instructions at https://icinga.com/company/contributor-agreement to sign the CLA.

After that, please reply here with a comment and we'll verify.

Contributors that have not signed yet: @yhabteab

• If you've already signed a CLA, it's possible we don't have your GitHub username or you're using a different email address. Please contact us if you think this is the case.

• If you signed the CLA as a corporation, your GitHub username may not have been submitted to us. Please reach out to the responsible person in your organization.

[Al2Klimov]

What's the problem here?

[julianbrost]

The account was renamed and this change is probably not yet reflected in our CLA check.

[lippserd]

@cla-bot check