# Copy this file, provide your own CA certificates and delegated OCSP
# signer certificate/key pairs, then mount it at /etc/ocsp/responder.yaml.
listen: 0.0.0.0:2560
next_update_seconds: 10

redis:
  # Same Redis instance and logical database used by KCA sessions.
  # OCSP_REDIS_URL overrides this value at runtime.
  url: redis://redis:6379/0
  prefix: ocsp
  cache_ttl_ms: 1000

issuers:
  - name: Example Root CA
    # UUID of this CA's certificate row in KCA (not its fingerprint).
    ca_id: 00000000-0000-0000-0000-000000000000
    ca_cert: /etc/ocsp/ca/root.pem
    signer_cert: /etc/ocsp/signers/root.pem
    signer_key: /etc/ocsp/signers/root.key
  # - name: Example Intermediate CA
  #   ca_id: 00000000-0000-0000-0000-000000000000
  #   ca_cert: /etc/ocsp/ca/intermediate.pem
  #   signer_cert: /etc/ocsp/signers/intermediate.pem
  #   signer_key: /etc/ocsp/signers/intermediate.key