I've been playing a bit with OCSP stapling in httpd and found the
documentation a bit lacking / confusing. httpd says:
ocsp file
Specify an OCSP response to be stapled during TLS
handshakes with this server. The file should contain a
DER-format OCSP response retrieved from an OCSP server
for the certificate in use. The default is to not use
OCSP stapling. If the OSCP response in file is empty,
OCSP stapling will not be used.
But from this bit of text it's not clear that we have ocspcheck(8) to
create these files. Only much further down is there a Xr to this
program. I've added a Xr in the description of the ocsp option to
make this easier to find for the uninitiated.
While there, I was rather surprised that the file argument is relative
to the root of the system, not the chroot of the httpd process. That
suggests (at least to me) that cron(8)'ing staple updates with
ocspcheck will require an httpd reload. Why can't that simply be read
from the chroot during runtime, so updates to the file take effect
without a restart? I have my staple file in the docroot (since I
understand it to be public data), is that a bad idea?
Anyway, thought it prudent to also add some words about this too, but
am less convinced it's correct.
Cheers,
Paul
Index: httpd.conf.5
===================================================================
RCS file: /cvs/src/usr.sbin/httpd/httpd.conf.5,v
retrieving revision 1.87
diff -u -p -r1.87 httpd.conf.5
--- httpd.conf.5 29 Nov 2017 16:55:08 -0000 1.87
+++ httpd.conf.5 20 Dec 2017 07:26:20 -0000
@@ -557,10 +557,16 @@ should contain a DER-format OCSP respons
OCSP server for the
.Ar certificate
in use.
+The
+.Xr ocspcheck 8
+utility can be used to create files in the proper format.
The default is to not use OCSP stapling.
If the OSCP response in
.Ar file
is empty, OCSP stapling will not be used.
+Note that the path to
+.Ar file
+is not relative to the chroot.
.It Ic protocols Ar string
Specify the TLS protocols to enable for this server.
If not specified, the value
--
>++++++++[<++++++++++>-]<+++++++.>+++[<------>-]<.>+++[<+
+++++++++++>-]<.>++[<------------>-]<+.--------------.[-]
http://www.weirdnet.nl/
