Fix cross-vault OCSP snapshot poisoning

2026-10-24 22:03:02 +00:00
parent 69d78939a1
commit dab4b9e0bb
9 changed files with 172 additions and 23 deletions
@@ -15,10 +15,13 @@ s3:

 issuers:
  - name: Example Root CA
+    # UUID of this CA's certificate row in KCA (not its fingerprint).
+    ca_id: 00000000-0000-0000-0000-000000000000
    ca_cert: /etc/ocsp/ca/root.pem
    signer_cert: /etc/ocsp/signers/root.pem
    signer_key: /etc/ocsp/signers/root.key
  # - name: Example Intermediate CA
+  #   ca_id: 00000000-0000-0000-0000-000000000000
  #   ca_cert: /etc/ocsp/ca/intermediate.pem
  #   signer_cert: /etc/ocsp/signers/intermediate.pem
  #   signer_key: /etc/ocsp/signers/intermediate.key