Documentation
¶
Index ¶
- func GetCertStatus(db *db.DB, engineFn func() *engine.Engine, caName, serialHex string) (*db.CertStatus, error)
- type Cache
- func (c *Cache) Get(key string) ([]byte, bool)
- func (c *Cache) Len() int
- func (c *Cache) Load(path string) error
- func (c *Cache) PurgeSerial(serial string)
- func (c *Cache) Save(path string) error
- func (c *Cache) Set(key string, data []byte)
- func (c *Cache) SetWithSerial(key, serial string, data []byte)
- type Config
- type Handler
- type StapleProvider
- func (p *StapleProvider) Close()
- func (p *StapleProvider) Refresh(cert *x509.Certificate) ([]byte, error)
- func (p *StapleProvider) Staple(cert *x509.Certificate) []byte
- func (p *StapleProvider) Start(interval time.Duration, certs func() []*x509.Certificate)
- func (p *StapleProvider) Warm(certs []*x509.Certificate)
- type StapleProviderConfig
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func GetCertStatus ¶
func GetCertStatus(db *db.DB, engineFn func() *engine.Engine, caName, serialHex string) (*db.CertStatus, error)
GetCertStatus resolves certificate status using the same engine→DB fallback policy as the OCSP responder. It is the shared status source for both the wire handler and the OCSP staple provider.
Types ¶
type Cache ¶
type Cache struct {
// contains filtered or unexported fields
}
func (*Cache) Load ¶
Load reads a previously persisted dump into the cache. Expired entries are dropped. Errors (missing file, corrupt JSON) are reported to the caller so the server can decide whether to fail or continue with an empty cache.
func (*Cache) PurgeSerial ¶
func (*Cache) Save ¶
Save serializes the cache (only unexpired entries) to path. It is safe to call concurrently; stale bytes on disk are overwritten atomically.
func (*Cache) SetWithSerial ¶
type Config ¶
type Config struct {
DB *db.DB
Engine func() *engine.Engine // optional memory engine getter; when non-nil and returns non-nil, status reads prefer it and fall back to DB
CACert *x509.Certificate
CAName string
SignerCert *x509.Certificate
SignerKey crypto.Signer
NextUpdate time.Duration
// MetricsHook, if set, is invoked with (caName, status) for each produced
// OCSP response, where status is one of "good", "revoked", "unknown".
MetricsHook func(caName, status string)
// CacheFile, when set, points to a persisted response cache that is loaded
// at startup and re-saved after each new response is produced. This lets a
// cold OCSP node (or a node that never contacts the CA database) serve
// verified responses from disk without hammering the shared store.
CacheFile string
}
type Handler ¶
type Handler struct {
// contains filtered or unexported fields
}
func NewHandler ¶
func (*Handler) Close ¶
func (h *Handler) Close()
Close flushes the persisted cache (if any). Safe to call multiple times.
func (*Handler) PurgeCert ¶
PurgeCert invalidates all cached responses for a certificate serial. It is called by the serve layer on revocation so clients are not served stale "good" responses from a cache whose entries can live for up to 24h. The persisted cache (when configured) is immediately re-saved so cold OCSP nodes stop serving the stale entry across restarts too.
type StapleProvider ¶
type StapleProvider struct {
// contains filtered or unexported fields
}
StapleProvider generates and caches OCSP stapling responses (RFC 6066) for leaf certificates, ready to be attached to tls.Certificate.OCSPStaple. It is the missing half of the Must-Staple extension (2.5.29.24): signing a certificate with Must-Staple signals the TLS server must serve a staple, and this provider supplies it.
The provider resolves certificate status through the same engine→DB fallback as the wire OCSP responder, so a server embedding it reuses the CA's authoritative status without running its own responder.
func NewStapleProvider ¶
func NewStapleProvider(cfg StapleProviderConfig) *StapleProvider
NewStapleProvider builds a provider. The status source (DB) may be nil only if every status is pre-warmed via Refresh ahead of serving.
func (*StapleProvider) Close ¶
func (p *StapleProvider) Close()
Close stops the background refresh loop. Safe to call multiple times.
func (*StapleProvider) Refresh ¶
func (p *StapleProvider) Refresh(cert *x509.Certificate) ([]byte, error)
Refresh generates (and caches) the staple for cert, returning its DER.
func (*StapleProvider) Staple ¶
func (p *StapleProvider) Staple(cert *x509.Certificate) []byte
Staple returns the cached staple DER for a certificate, or nil if the cert has not been refreshed (or its status is unknown/expired with no cached value). The caller should attach it to tls.Certificate.OCSPStaple.
func (*StapleProvider) Start ¶
func (p *StapleProvider) Start(interval time.Duration, certs func() []*x509.Certificate)
Start launches a background refresh loop for the given certificates. Close must be called to stop it.
func (*StapleProvider) Warm ¶
func (p *StapleProvider) Warm(certs []*x509.Certificate)
Warm pre-computes staples for a set of leaf certificates.
type StapleProviderConfig ¶
type StapleProviderConfig struct {
// CAName is the issuing CA name whose certificates are stapled.
CAName string
// CACert is the issuing CA certificate (the responder issuer).
CACert *x509.Certificate
// SignerCert / SignerKey identify the OCSP responder signing the staple.
SignerCert *x509.Certificate
SignerKey crypto.Signer
// NextUpdate is the OCSP response validity window (default 24h).
NextUpdate time.Duration
// DB is the status source (engine preferred via Engine).
DB *db.DB
// Engine, when non-nil and returning a non-nil engine, is the preferred
// in-memory status source (engine → DB fallback, same as the responder).
Engine func() *engine.Engine
}
StapleProviderConfig carries the inputs for a StapleProvider.
Source Files