KCA
d22ba6662c
- Parse and validate from snapshot JSON, reject future/missing timestamps - Enforce snapshot age vs in cache and stale fallback (no lifetime extension on repeat S3 reads) - OCSP: , , - Remove unused from signer - Publisher heartbeats: , republish clean snapshots past interval, preserve dirty-only behavior and concurrency - Config/env/docker/docs updates for heartbeat Rolling upgrade: enable publisher heartbeats before deploying the age-enforcing responder so existing snapshots remain within the age window.
29 lines
1010 B
YAML
29 lines
1010 B
YAML
# Copy this file, provide your own CA certificates and delegated OCSP
|
|
# signer certificate/key pairs, then mount it at /etc/ocsp/responder.yaml.
|
|
listen: 0.0.0.0:2560
|
|
next_update_seconds: 10
|
|
|
|
s3:
|
|
bucket: kca-ocsp
|
|
prefix: ocsp
|
|
region: eu-central-1
|
|
# Optional for MinIO / other S3-compatible stores:
|
|
# endpoint: https://s3.example.com
|
|
# force_path_style: true
|
|
cache_ttl_ms: 1000
|
|
# Hard maximum snapshot age. Keep comfortably above KCA's heartbeat interval.
|
|
stale_grace_seconds: 60
|
|
|
|
issuers:
|
|
- name: Example Root CA
|
|
# UUID of this CA's certificate row in KCA (not its fingerprint).
|
|
ca_id: 00000000-0000-0000-0000-000000000000
|
|
ca_cert: /etc/ocsp/ca/root.pem
|
|
signer_cert: /etc/ocsp/signers/root.pem
|
|
signer_key: /etc/ocsp/signers/root.key
|
|
# - name: Example Intermediate CA
|
|
# ca_id: 00000000-0000-0000-0000-000000000000
|
|
# ca_cert: /etc/ocsp/ca/intermediate.pem
|
|
# signer_cert: /etc/ocsp/signers/intermediate.pem
|
|
# signer_key: /etc/ocsp/signers/intermediate.key
|