Allow dedicated Redis for OCSP publication

ocsp-responder/README.md

@@ -6,16 +6,17 @@ OCSP responses with a delegated responder certificate.
 
 It has **no KCA database access** and no KCA master key. It only needs:
 
-- read access to OCSP keys in the same Redis instance and logical database KCA
-  uses for sessions;
+- read access to OCSP keys in the Redis instance selected by KCA (the session
+  Redis by default, or a dedicated instance when `KCA_OCSP_REDIS_URL` is set);
 - the CA certificate and its KCA CA UUID for each issuer;
 - a delegated OCSP signer certificate and private key for each CA. The
   responder currently accepts RSA-SHA256 and ECDSA P-256 signers in PKCS#8,
   PKCS#1 RSA, or SEC1 EC PEM form.
 
 Where Redis ACLs are available, restrict the responder's credentials to the
-OCSP prefix so it cannot read session entries. KCA needs access to both
-`ocsp:*` and `kaya:session:*`.
+OCSP prefix so it cannot read session entries. When sharing an instance, KCA
+needs access to both `ocsp:*` and `kaya:session:*`; a dedicated OCSP instance
+can use separate credentials.
 
 ## Snapshot layout
 
@@ -30,7 +31,8 @@ its CA certificate row in KCA. This isolates snapshots when the same public CA
 certificate exists in multiple vaults. The responder validates both this ID and
 the CA certificate fingerprint against every downloaded snapshot.
 
-KCA publishes these keys when `REDIS_URL` is configured. The
+KCA publishes these keys when either `REDIS_URL` or `KCA_OCSP_REDIS_URL` is
+configured, preferring the dedicated OCSP URL when both are present. The
 `kca-ocsp-status/v2` payload is encoded with CBOR and contains all certificates
 issued by that CA, both valid and revoked, without a generation timestamp.
 Freshness is carried by the Redis key TTL. The responder never infers status
@@ -41,7 +43,8 @@ coordinated because legacy JSON payloads are rejected until republished.
 
 1. Create a config based on `responder.example.yaml`, setting each issuer's
    `ca_id` to its CA certificate UUID in KCA.
-2. Set `redis.url` or `OCSP_REDIS_URL` to the same Redis URL used by KCA.
+2. Set `redis.url` or `OCSP_REDIS_URL` to the OCSP Redis URL used by KCA (the
+   session `REDIS_URL` unless `KCA_OCSP_REDIS_URL` overrides it).
 3. Put your CA certificates and delegated signer files where the config points.
 4. Make the signer key readable by the container user (`65532:65532` in the
    published scratch image), or mount it via a Docker secret.

ocsp-responder/responder.example.yaml

@@ -4,7 +4,7 @@ listen: 0.0.0.0:2560
 next_update_seconds: 10
 
 redis:
-  # Same Redis instance and logical database used by KCA sessions.
+  # OCSP Redis used by KCA (the session Redis unless KCA_OCSP_REDIS_URL is set).
   # OCSP_REDIS_URL overrides this value at runtime.
   url: redis://redis:6379/0
   prefix: ocsp