Fix cross-vault OCSP snapshot poisoning

server/packages/kca-app/src/kca/ocsp.py

@@ -32,10 +32,10 @@ def _iso(value: Optional[datetime]) -> Optional[str]:
     return value.astimezone(timezone.utc).isoformat()
 
 
-def object_key(ca_fingerprint_sha256: str) -> str:
-    """The S3 key for one CA; the responder derives the same key."""
+def object_key(ca_id: str) -> str:
+    """The S3 key for one CA database row; the responder uses the same CA ID."""
     prefix = settings.ocsp_s3_prefix.strip("/")
-    name = f"{ca_fingerprint_sha256.lower()}.json"
+    name = f"{ca_id.lower()}.json"
     return f"{prefix}/{name}" if prefix else name
 
 
@@ -104,7 +104,7 @@ async def publish_snapshot(ca: Certificate, snapshot: Optional[Dict[str, Any]] =
     if snapshot is None:
         snapshot = await snapshot_for_ca(ca)
     body = json.dumps(snapshot, indent=2, sort_keys=True).encode("utf-8")
-    key = object_key(ca.fingerprint_sha256)
+    key = object_key(str(ca.id))
 
     # boto3 is synchronous and credential resolution can block; do both the
     # client creation and the PUT outside the event loop.