Publish OCSP snapshots through Redis

server/.env.example

@@ -66,21 +66,15 @@ OTEL_EXCLUDED_PATHS=/api/health
 #OTEL_METRICS_POLL_INTERVAL_SECONDS=15
 
 # --- OCSP status publisher (optional) --------------------------------------
-# When a bucket is configured, KCA publishes one full JSON status snapshot
-# per CA. The standalone OCSP responder reads these objects. Uses the normal
-# AWS credential chain (AWS_ACCESS_KEY_ID /
-# AWS_SECRET_ACCESS_KEY, role, instance profile, ...).
-#KCA_OCSP_S3_BUCKET=kca-ocsp
-KCA_OCSP_S3_PREFIX=ocsp
-#KCA_OCSP_S3_REGION=eu-central-1
-#KCA_OCSP_S3_ENDPOINT=http://localhost:9000
-KCA_OCSP_S3_FORCE_PATH_STYLE=false
+# When REDIS_URL is configured, KCA publishes one full JSON status snapshot
+# per CA to the same Redis instance and logical database used for sessions.
+# Keys use a separate prefix and expire unless refreshed by the heartbeat.
+KCA_OCSP_REDIS_PREFIX=ocsp
 KCA_OCSP_PUBLISH_INTERVAL_SECONDS=1
-# Republish unchanged snapshots as a liveness heartbeat. Each object receives
-# an Expires header; the responder rejects it after that timestamp. Keep the
-# heartbeat comfortably below the object expiry.
+# Republish unchanged snapshots to renew their Redis TTL. Keep the heartbeat
+# comfortably below the key expiry.
 KCA_OCSP_HEARTBEAT_INTERVAL_SECONDS=30
-KCA_OCSP_OBJECT_EXPIRY_SECONDS=60
+KCA_OCSP_REDIS_EXPIRY_SECONDS=60
 
 # --- CORS (optional) -------------------------------------------------------
 #CORS_ALLOW_ORIGINS=