Add AIA certificate prober to boulder-observer #8594

Copilot · 2026-01-23T23:02:09Z

Summary

All implementation tasks have been completed successfully. The AIA certificate prober:

Makes HTTP requests with proper timeout handling
Validates DER-formatted certificates
Checks Content-Type headers (application/pkix-cert)
Verifies certificates are CA certificates (IsCA=true)
Validates certificate CommonName matches expected value via required ExpectCommonName config field
Logs detailed error messages for all failure cases to aid debugging
Exports Prometheus metrics for certificate validity periods (notBefore/notAfter)
Includes comprehensive tests covering all validation scenarios
Follows existing prober patterns (similar to CRL prober)
Passes all tests and security checks
Properly registered in Kind validation tag

Configuration

The AIA prober requires the following configuration options:

url (required): URL to fetch the AIA certificate from
expectCommonName (required): Expected CommonName (CN) of the certificate for validation

Example:

monitors:
  - 
    period: 1h
    kind: AIA
    settings:
      url: http://r3.i.lencr.org/
      expectCommonName: "R3"

Debug Logging

The prober includes detailed log messages for all failure scenarios:

HTTP request creation failure
Certificate fetch failure
Incorrect Content-Type header
Response body read failure
Certificate parsing failure
Non-CA certificate detection
CommonName mismatch

These log messages help with debugging and include the URL and relevant details for each failure case.

Original prompt

This section details on the original issue you should resolve

<issue_title>boulder-observer: Add a check for AIA certs</issue_title>
<issue_description>Boulder-observer contains several domain-specific probers, like CRLs. We should add a new prober for AIA certificates. This will make a plaintext http connect to a configured URL, like the CRL one does.

We should also support checking AIA certificates, check that they're properly formatted DER certificates, and are served with the right content-type. They should export at least a metric with the observed certificate's notbefore and notafter times, in keeping with other probers.</issue_description>

<agent_instructions>Focus on high-quality code that fits with the rest of the codebase. Do not be overly verbose.</agent_instructions>

Comments on the Issue (you are @copilot in this section)

Fixes boulder-observer: Add a check for AIA certs #8593

Co-authored-by: mcpherrinm <47425+mcpherrinm@users.noreply.github.com>

mcpherrinm · 2026-01-23T23:25:29Z

@copilot test failure " main_test.go:68: Failed to validate config file "observer.yml": Key: 'ObsConf.MonConfs[11].Kind' Error:Field validation for 'Kind' failed on the 'oneof' tag"

Fixes test failure where AIA kind was not recognized in the oneof validation tag. Co-authored-by: mcpherrinm <47425+mcpherrinm@users.noreply.github.com>

Copilot · 2026-01-23T23:28:53Z

@copilot test failure " main_test.go:68: Failed to validate config file "observer.yml": Key: 'ObsConf.MonConfs[11].Kind' Error:Field validation for 'Kind' failed on the 'oneof' tag"

Fixed in e9291c5. Added "AIA" to the Kind validation tag in observer/mon_conf.go so it's now recognized as a valid prober kind.

mcpherrinm · 2026-01-26T16:50:18Z

@copilot Add a config field, ExpectCommonName, which the prober checks if the received certificate matches, to ensure the correct certificate was served. Check the recieved certificate is also a CA Cert

- Add optional ExpectCommonName config field to verify certificate CN - Validate that received certificate is a CA certificate (IsCA=true) - Update tests to use CA certificates and test new validations - Update documentation with new config field and examples Co-authored-by: mcpherrinm <47425+mcpherrinm@users.noreply.github.com>

Copilot · 2026-01-26T16:54:30Z

@copilot Add a config field, ExpectCommonName, which the prober checks if the received certificate matches, to ensure the correct certificate was served. Check the recieved certificate is also a CA Ce...

Implemented in 1cad83f. Added:

ExpectCommonName config field (optional) to verify the certificate's CN matches the expected value
CA certificate validation - the prober now checks that cert.IsCA is true
Tests for both new validations including matching/non-matching CN and non-CA certificates

mcpherrinm · 2026-01-26T16:58:17Z

@copilot Don't make ExpectCommonName optional. It must be provided and checked.

Add log messages to the different failure cases in probing for debugging why something is gone wrong

- Make ExpectCommonName a required field with validation - Add log messages for all failure cases in probe: - HTTP request creation failure - Certificate fetch failure - Incorrect Content-Type - Response body read failure - Certificate parsing failure - Non-CA certificate - CommonName mismatch - Update tests to always include ExpectCommonName - Update documentation to reflect ExpectCommonName is required Co-authored-by: mcpherrinm <47425+mcpherrinm@users.noreply.github.com>

Copilot · 2026-01-26T17:03:28Z

@copilot Don't make ExpectCommonName optional. It must be provided and checked.

Add log messages to the different failure cases in probing for debugging why something is gone wrong

Implemented in 7202d58:

ExpectCommonName is now required - validation fails if not provided
Added debug log messages for all failure cases:
- HTTP request creation failure
- Certificate fetch failure
- Incorrect Content-Type header
- Response body read failure
- Certificate parsing failure
- Non-CA certificate detection
- CommonName mismatch

aarongable · 2026-01-26T17:48:17Z

observer/probers/aia/aia.go

+
+	req, err := http.NewRequestWithContext(ctx, "GET", p.url, nil)
+	if err != nil {
+		log.Printf("AIA probe %s: failed to create request: %v", p.url, err)


None of the other individual probers have log lines like this (though the higher-level obvserver and monitor do). A line printed through the stdlib log package won't respect our configured log level or log formatting.

aarongable · 2026-01-26T17:51:53Z

observer/probers/aia/aia.go

+	ctx, cancel := context.WithTimeout(context.Background(), timeout)
+	defer cancel()


Noticed that we're not actually using the timeout in all our other probers. Filed a bug for that: #8598

aarongable · 2026-01-26T17:57:00Z

observer/probers/aia/aia_test.go

+		colls := conf.Instrument()
+		prober, err := conf.MakeProber(colls)


Here and same below:

Suggested change

colls := conf.Instrument()

prober, err := conf.MakeProber(colls)

prober, err := conf.MakeProber(conf.Instrument())

aarongable · 2026-01-26T17:58:37Z

observer/probers/aia/aia_test.go

+	test.AssertNotError(t, err, "gathering metrics")
+
+	// Verify we have the expected metrics
+	test.AssertEquals(t, len(metricFamilies), 2)


This checks that we have metrics, but doesn't check that they have sensical values. We have test.AssertMetricWithLabelEquals as a helper for this, if you want to use that.

aarongable

Also please update the PR description to be something a human would like to read in the git log.

Initial plan

8a042e2

Copilot AI assigned Copilot and mcpherrinm Jan 23, 2026

Copilot started work on behalf of mcpherrinm January 23, 2026 23:02 View session

Copilot AI and others added 5 commits January 23, 2026 23:06

Add AIA certificate prober implementation with tests

5b9ebe5

Co-authored-by: mcpherrinm <47425+mcpherrinm@users.noreply.github.com>

Add AIA prober documentation and configuration example

eef3acb

Co-authored-by: mcpherrinm <47425+mcpherrinm@users.noreply.github.com>

Add integration tests for AIA prober Probe method

e5e4121

Co-authored-by: mcpherrinm <47425+mcpherrinm@users.noreply.github.com>

Fix timeout handling and nil pointer check in AIA prober

defc245

Co-authored-by: mcpherrinm <47425+mcpherrinm@users.noreply.github.com>

Fix formatting in AIA prober

11e7439

Copilot AI changed the title ~~[WIP] Add check for AIA certificates in boulder-observer~~ Add AIA certificate prober to boulder-observer Jan 23, 2026

Copilot AI requested a review from mcpherrinm January 23, 2026 23:13

Copilot finished work on behalf of mcpherrinm January 23, 2026 23:13

Copilot started work on behalf of mcpherrinm January 23, 2026 23:25 View session

Add AIA to Kind validation tag in mon_conf.go

e9291c5

Fixes test failure where AIA kind was not recognized in the oneof validation tag. Co-authored-by: mcpherrinm <47425+mcpherrinm@users.noreply.github.com>

Copilot finished work on behalf of mcpherrinm January 23, 2026 23:29

Copilot started work on behalf of mcpherrinm January 26, 2026 16:50 View session

Copilot finished work on behalf of mcpherrinm January 26, 2026 16:55

Copilot started work on behalf of mcpherrinm January 26, 2026 16:58 View session

Copilot finished work on behalf of mcpherrinm January 26, 2026 17:04

mcpherrinm approved these changes Jan 26, 2026

View reviewed changes

Merge branch 'main' into copilot/add-aia-certificate-prober

5212c08

mcpherrinm marked this pull request as ready for review January 26, 2026 17:57

mcpherrinm requested a review from a team as a code owner January 26, 2026 17:57

mcpherrinm requested a review from beautifulentropy January 26, 2026 17:57

aarongable reviewed Jan 26, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Add AIA certificate prober to boulder-observer #8594

Add AIA certificate prober to boulder-observer #8594

Uh oh!

Copilot AI commented Jan 23, 2026 •

edited by mcpherrinm

Loading

Uh oh!

mcpherrinm commented Jan 23, 2026

Uh oh!

Copilot AI commented Jan 23, 2026

Uh oh!

mcpherrinm commented Jan 26, 2026

Uh oh!

Copilot AI commented Jan 26, 2026

Uh oh!

mcpherrinm commented Jan 26, 2026

Uh oh!

Copilot AI commented Jan 26, 2026

Uh oh!

aarongable Jan 26, 2026

Uh oh!

aarongable Jan 26, 2026

Uh oh!

aarongable Jan 26, 2026

Uh oh!

aarongable Jan 26, 2026

Uh oh!

aarongable left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		ctx, cancel := context.WithTimeout(context.Background(), timeout)
		defer cancel()

		colls := conf.Instrument()
		prober, err := conf.MakeProber(colls)

	colls := conf.Instrument()
	prober, err := conf.MakeProber(colls)
	prober, err := conf.MakeProber(conf.Instrument())

Uh oh!

Add AIA certificate prober to boulder-observer #8594

Are you sure you want to change the base?

Add AIA certificate prober to boulder-observer #8594

Uh oh!

Conversation

Copilot AI commented Jan 23, 2026 • edited by mcpherrinm Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Configuration

Debug Logging

Comments on the Issue (you are @copilot in this section)

Uh oh!

mcpherrinm commented Jan 23, 2026

Uh oh!

Copilot AI commented Jan 23, 2026

Uh oh!

mcpherrinm commented Jan 26, 2026

Uh oh!

Copilot AI commented Jan 26, 2026

Uh oh!

mcpherrinm commented Jan 26, 2026

Uh oh!

Copilot AI commented Jan 26, 2026

Uh oh!

aarongable Jan 26, 2026

Choose a reason for hiding this comment

Uh oh!

aarongable Jan 26, 2026

Choose a reason for hiding this comment

Uh oh!

aarongable Jan 26, 2026

Choose a reason for hiding this comment

Uh oh!

aarongable Jan 26, 2026

Choose a reason for hiding this comment

Uh oh!

aarongable left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Jan 23, 2026 •

edited by mcpherrinm

Loading