woggioni/kca
2
0
Fork 0
Code Actions Packages Releases Activity

Fix stale OCSP snapshots indefinitely

Browse Source 
- Parse and validate  from snapshot JSON, reject future/missing timestamps
- Enforce snapshot age vs  in cache and stale fallback (no lifetime extension on repeat S3 reads)
- OCSP: , ,
- Remove unused  from signer
- Publisher heartbeats: , republish clean snapshots past interval, preserve dirty-only behavior and concurrency
- Config/env/docker/docs updates for heartbeat

Rolling upgrade: enable publisher heartbeats before deploying the age-enforcing responder so existing snapshots remain within the age window.
This commit is contained in:
KCA
2026-10-25 21:30:00 +00:00
parent ec42cafc28
commit d22ba6662c
12 changed files with 299 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ocsp-responder/responder.example.yaml
+1
View File
@@ -11,6 +11,7 @@ s3:
# endpoint: https://s3.example.com
# force_path_style: true
cache_ttl_ms: 1000
# Hard maximum snapshot age. Keep comfortably above KCA's heartbeat interval.
stale_grace_seconds: 60
issuers: