# Copy this file, provide your own CA certificates and delegated OCSP
# signer certificate/key pairs, then mount it at /etc/ocsp/responder.yaml.
listen: 0.0.0.0:2560
next_update_seconds: 10

s3:
  bucket: kca-ocsp
  prefix: ocsp
  region: eu-central-1
  # Optional for MinIO / other S3-compatible stores:
  # endpoint: https://s3.example.com
  # force_path_style: true
  cache_ttl_ms: 1000
  stale_grace_seconds: 60

issuers:
  - name: Example Root CA
    # UUID of this CA's certificate row in KCA (not its fingerprint).
    ca_id: 00000000-0000-0000-0000-000000000000
    ca_cert: /etc/ocsp/ca/root.pem
    signer_cert: /etc/ocsp/signers/root.pem
    signer_key: /etc/ocsp/signers/root.key
  # - name: Example Intermediate CA
  #   ca_id: 00000000-0000-0000-0000-000000000000
  #   ca_cert: /etc/ocsp/ca/intermediate.pem
  #   signer_cert: /etc/ocsp/signers/intermediate.pem
  #   signer_key: /etc/ocsp/signers/intermediate.key