Fix OCSP snapshots for orphaned revocations

server/packages/kca-app/src/kca/ocsp.py

@@ -42,17 +42,19 @@ def object_key(ca_id: str) -> str:
 async def snapshot_for_ca(ca: Certificate) -> Dict[str, Any]:
     """Build the full OCSP status snapshot for certificates issued by ``ca``."""
     certs = await Certificate.filter(vault_id=ca.vault_id, issuer_id=ca.id).order_by("serial_hex")  # type: ignore[attr-defined]
+    certs_by_serial = {cert.serial_hex.lower(): cert for cert in certs}
     revocations = {
         row.serial_hex.lower(): row
         for row in await CertificateRevocation.filter(ca_id=ca.id)
     }
     entries = []
-    for cert in certs:
-        revocation = revocations.get(cert.serial_hex.lower())
+    for serial in sorted(certs_by_serial.keys() | revocations.keys()):
+        cert = certs_by_serial.get(serial)
+        revocation = revocations.get(serial)
         entry: Dict[str, Any] = {
-            "serial_hex": cert.serial_hex.lower(),
+            "serial_hex": serial,
             "status": "revoked" if revocation is not None else "valid",
-            "not_after": _iso(cert.not_after),
+            "not_after": _iso(cert.not_after) if cert is not None else None,
         }
         if revocation is not None:
             entry.update(

server/packages/kca-app/src/kca/service.py

@@ -1365,7 +1365,7 @@ async def import_parsed_items(
     await relink_certificates(vault)
     # Merge the revocations carried by imported CRLs into their CA, as XCA
     # does when a CRL is imported.
-    for crl in await Crl.filter(vault_id=vault.id, issuer_id__not=None):
+    for crl in await Crl.filter(vault_id=vault.id, issuer_id__isnull=False):
         ca = await Certificate.get_or_none(id=crl.issuer_id, vault_id=vault.id)
         if ca is None:
             continue