Documentation
¶
Overview ¶
Package ocsp is the OCSP revocation-checking engine for upstream TLS certificates: a TTL'd verdict cache plus the responder query pipeline behind a tls.Config VerifyPeerCertificate callback. Extracted from package main per ADR-0002; the transport wiring (ConfigureTLSConfigOCSP / ConfigureTransportOCSP, under the P5.3 upstream-transport ownership contract) and the globalOCSP singleton stay in main (ocsp.go shim).
When enabled, the proxy verifies that upstream server certificates have not been revoked by checking OCSP stapled responses and, as a fallback, querying OCSP responders listed in the certificate's AIA extension.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Checker ¶
type Checker struct {
// contains filtered or unexported fields
}
Checker performs OCSP-based revocation checking for TLS connections.
func New ¶
func New() *Checker
New returns a Checker with an empty verdict cache (disabled until Enable).
func (*Checker) CleanupCache ¶
func (oc *Checker) CleanupCache()
CleanupCache evicts expired entries from the OCSP cache.
func (*Checker) VerifyPeerCertificate ¶
func (oc *Checker) VerifyPeerCertificate(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) error
VerifyPeerCertificate is a tls.Config.VerifyPeerCertificate callback that checks OCSP revocation status for the peer's leaf certificate.
Source Files