Re: Old style OCSP not working anymore?

2023-07-13 Thread Shawn Heisey
On 7/13/23 17:56, Shawn Heisey wrote: I do still use this script on one of my servers where I can't get haproxy's built-in ocsp updating to work right.  It is haproxy 2.8.1. A few minutes ago, I fixed the problem on that server with haproxy's built-in OCSP updater, so the script is officially

Re: Wierd issue with OCSP updating

2023-07-13 Thread Shawn Heisey
On 7/13/23 15:00, Cyril Bonté wrote: Hi Shawn, Le 13/07/2023 à 18:48, Shawn Heisey a écrit : Looks like on my last edit I deleted it and didn't add it to defaults, so I was wrong in what I said.  It throws a different error when added to defaults: Because it should be in the global section,

Re: Old style OCSP not working anymore?

2023-07-13 Thread Shawn Heisey
On 7/13/23 09:01, Sander Klein wrote: I tried upgrading from 2.6.14 to 2.8.1, but after the upgrade I couldn't connect to any of the sites behind it. While looking at the error it seems like OCSP is not working anymore. Right now I have a setup in which I provision the certificates with the

Re: Wierd issue with OCSP updating

2023-07-13 Thread Cyril Bonté
Hi Shawn, Le 13/07/2023 à 18:48, Shawn Heisey a écrit : Looks like on my last edit I deleted it and didn't add it to defaults, so I was wrong in what I said.  It throws a different error when added to defaults: elyograg@bilbo:~$ sudo haproxy -dD -c -f /etc/haproxy/haproxy.cfg [NOTICE]  

Re: Wierd issue with OCSP updating

2023-07-13 Thread Shawn Heisey
On 7/12/23 04:13, Remi Tricot-Le Breton wrote: On 11/07/2023 22:22, Shawn Heisey wrote: On 7/11/23 01:30, Remi Tricot-Le Breton wrote: That directive didn't work in "global" but it was accepted when I moved it to "defaults".  But it didn't change the behavior.  IPv6 is completely disabled on

Old style OCSP not working anymore?

2023-07-13 Thread Sander Klein
Hi, I tried upgrading from 2.6.14 to 2.8.1, but after the upgrade I couldn't connect to any of the sites behind it. While looking at the error it seems like OCSP is not working anymore. Right now I have a setup in which I provision the certificates with the corresponding ocsp file next to

Re: [PATCH] BUILD: ssl: Build with new cryptographic library AWS-LC

2023-07-13 Thread Aleksandar Lazic
Hi Andrew. Thank you for your answers. On 2023-07-13 (Do.) 08:22, Hopkins, Andrew wrote: Hi Alex, thanks for taking a look at this change, to answer your questions: * Do you plan to make releases which stable ABI on that we can rely on? Yes, we have releases on GitHub that follow semantic

Re: [PATCH] BUILD: ssl: Build with new cryptographic library AWS-LC

2023-07-13 Thread Илья Шипицин
another significant thing is developer velocity, 4 min for supplementary lib build is too high. [image: image.png] can we implement something like current openssl (i.e. taking the last available tag, which is even easier because aws-lc uses semantic versioning) @functools.lru_cache(5) def

Re: [PATCH] BUILD: ssl: Build with new cryptographic library AWS-LC

2023-07-13 Thread Илья Шипицин
maybe we'll join both VTest sections like that [image: image.png] чт, 13 июл. 2023 г. в 01:45, Hopkins, Andrew : > > Thanks for the tip, I got the CI running and it found a minor visibility > issue that we had to fix with our shared build [1]. All but one test [2] is > now passing in the

Re: [PATCH] BUILD: ssl: Build with new cryptographic library AWS-LC

2023-07-13 Thread Hopkins, Andrew
Hi Alex, thanks for taking a look at this change, to answer your questions: * Do you plan to make releases which stable ABI on that we can rely on? Yes, we have releases on GitHub that follow semantic versioning and within minor versions everything is backward compatible. Internal details of