woggioni/kca
2
0
Fork 0
Code Actions Packages Releases Activity

Serialize OCSP Redis snapshots with CBOR

Browse Source
This commit is contained in:
woggioni
2026-10-28 20:54:19 +00:00
parent df98ada177
commit ef64c4a532
12 changed files with 191 additions and 56 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+2 -2
View File
@@ -199,8 +199,8 @@ Rust/Axum responder on port `2560`.
- KCA publishes `ocsp:<KCA CA UUID>` whenever certificates are issued, renewed,
revoked, deleted or imported. Revocation reasons are included; this is a full
status snapshot, not a revoked-only list. OCSP keys are separate from session
keys through their prefix.
CBOR-encoded status snapshot, not a revoked-only list. OCSP keys are separate
from session keys through their prefix.
- The responder has no Postgres or KCA master-key access. It reads only OCSP
snapshots from Redis and uses a delegated OCSP signing certificate/key per
CA. Where Redis ACLs are available, restrict the responder to `ocsp:*` so it