Serialize OCSP Redis snapshots with CBOR

server/packages/kca-app/pyproject.toml

@@ -26,6 +26,7 @@ dependencies = [
     "PyYAML",
     "redis",
     "cryptography>=44",
+    "cbor2",
     "pyOpenSSL>=25",
     "paramiko>=3.5",
 ]

server/packages/kca-app/src/kca/ocsp.py

@@ -1,19 +1,19 @@
 """Per-CA OCSP status snapshots and Redis publication.
 
 KCA is the source of truth for certificate status. This module builds a
-compact JSON document per CA and stores it in the same Redis instance used for
+compact CBOR document per CA and stores it in the same Redis instance used for
 sessions, so the standalone OCSP responder never needs database access or a CA
 private key.
 """
 from __future__ import annotations
 
 import asyncio
-import json
 import logging
 from datetime import datetime, timedelta, timezone
 from typing import Any, Awaitable, Callable, Dict, Optional
 from uuid import UUID
 
+import cbor2
 from kaya.core import KayaApp, KayaMixin
 from redis.asyncio import Redis
 from tortoise.expressions import Q
@@ -92,7 +92,7 @@ async def publish_snapshot(
     """Store one CA snapshot with an expiry and return its Redis key."""
     if snapshot is None:
         snapshot = await snapshot_for_ca(ca)
-    body = json.dumps(snapshot, indent=2, sort_keys=True).encode("utf-8")
+    body = cbor2.dumps(snapshot)
     key = redis_key(str(ca.id))
 
     owned_client = None