Documentation
¶
Overview ¶
Package ocsp is the OCSP revocation-checking engine for upstream TLS certificates: a TTL'd verdict cache plus the responder query pipeline behind a tls.Config VerifyPeerCertificate callback. Extracted from package main per ADR-0002; the transport wiring (ConfigureTLSConfigOCSP / ConfigureTransportOCSP, under the P5.3 upstream-transport ownership contract) and the globalOCSP singleton stay in main (ocsp.go shim).
When enabled, the proxy verifies that upstream server certificates have not been revoked by checking OCSP stapled responses and, as a fallback, querying OCSP responders listed in the certificate's AIA extension.
Index ¶
- type Checker
- func (oc *Checker) CacheLen() int
- func (oc *Checker) CleanupCache()
- func (oc *Checker) Disable()
- func (oc *Checker) Enable()
- func (oc *Checker) Enabled() bool
- func (oc *Checker) FailClosedTotal() int64
- func (oc *Checker) LastFailClosedAt() time.Time
- func (oc *Checker) RevokedTotal() int64
- func (oc *Checker) VerifyPeerCertificate(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) error
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Checker ¶
type Checker struct {
// contains filtered or unexported fields
}
Checker performs OCSP-based revocation checking for TLS connections.
func New ¶
func New() *Checker
New returns a Checker with an empty verdict cache (disabled until Enable).
func (*Checker) CleanupCache ¶
func (oc *Checker) CleanupCache()
CleanupCache evicts expired entries from the OCSP cache.
func (*Checker) FailClosedTotal ¶ added in v1.0.48
FailClosedTotal returns the number of times a peer certificate was treated as revoked because every OCSP responder listed on it was unreachable.
func (*Checker) LastFailClosedAt ¶ added in v1.0.48
LastFailClosedAt returns the time of the most recent fail-closed event, or the zero time if none has occurred.
func (*Checker) RevokedTotal ¶ added in v1.0.48
RevokedTotal returns the number of times an OCSP responder confirmed a peer certificate as actually revoked.
func (*Checker) VerifyPeerCertificate ¶
func (oc *Checker) VerifyPeerCertificate(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) error
VerifyPeerCertificate is a tls.Config.VerifyPeerCertificate callback that checks OCSP revocation status for the peer's leaf certificate.
Source Files