Fix cross-vault OCSP snapshot poisoning

ocsp-responder/src/config.rs

@@ -20,6 +20,7 @@ pub struct Config {
 #[derive(Debug, Clone, Deserialize)]
 pub struct IssuerConfig {
     pub name: String,
+    pub ca_id: String,
     pub ca_cert: PathBuf,
     pub signer_cert: PathBuf,
     pub signer_key: PathBuf,
@@ -55,9 +56,9 @@ impl Default for S3Config {
 }
 
 impl S3Config {
-    pub fn object_key(&self, ca_fingerprint_sha256: &str) -> String {
+    pub fn object_key(&self, ca_id: &str) -> String {
         let prefix = self.prefix.trim_matches('/');
-        let name = format!("{}.json", ca_fingerprint_sha256.to_lowercase());
+        let name = format!("{}.json", ca_id.to_lowercase());
         if prefix.is_empty() {
             name
         } else {
@@ -104,3 +105,20 @@ pub fn load_config() -> Result<Config, Box<dyn std::error::Error + Send + Sync>>
     }
     Ok(config)
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn object_key_uses_ca_id() {
+        let config = S3Config {
+            prefix: "ocsp".to_string(),
+            ..Default::default()
+        };
+        assert_eq!(
+            config.object_key("123E4567-E89B-12D3-A456-426614174000"),
+            "ocsp/123e4567-e89b-12d3-a456-426614174000.json"
+        );
+    }
+}