https://github.com/stustanet/ocsp-forwarder

https://github.com/stustanet/ocsp-forwarder

nginx ocsp ocsp-proxy ocsp-staple ocsp-stapling

Last synced: about 19 hours ago
JSON representation

• Host: GitHub
• URL: https://github.com/stustanet/ocsp-forwarder
• Owner: stustanet
• License: mit
• Created: 2018-04-25T19:32:54.000Z (over 6 years ago)
• Default Branch: master
• Last Pushed: 2022-04-22T18:17:17.000Z (over 2 years ago)
• Last Synced: 2024-06-20T04:20:03.775Z (5 months ago)
• Topics: nginx, ocsp, ocsp-proxy, ocsp-staple, ocsp-stapling
• Language: Go
• Homepage: https://gitlab.stusta.de/stustanet/ocsp-forwarder
• Size: 19.5 KB
• Stars: 2
• Watchers: 6
• Forks: 0
• Open Issues: 0
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

README

        
# OCSP Forwarder

A workaround for web servers without HTTP proxy support for OCSP requests to use an HTTP proxy nonetheless.

## Setup

```sh

# add system user for OCSP Forwarder

useradd --system -s /bin/false -M ocsp-forwarder

# Make sure that Go and git are installed. For Debian Stretch:

apt install git

apt install -t stretch-backports golang

# install go package

GOPATH=/usr/local/src/go GOBIN=/usr/local/bin go get github.com/stustanet/ocsp-forwarder

# install and start systemd service

cp /usr/local/src/go/src/github.com/stustanet/ocsp-forwarder/systemd/ocsp-forwarder.service /etc/systemd/system/

# edit /etc/systemd/system/ocsp-forwarder.service

systemctl enable --now ocsp-forwarder.service

```

Adjust the parameters in the `/etc/systemd/system/ocsp-forwarder.service` as nedeed. For Let's Encrypt X3 certificates the `responder_url` is `http://r3.o.lencr.org/`.

In the nginx config (server block):

```

ssl_stapling_responder http://127.0.0.1:8234;

```

[`ssl_trusted_certificate`](https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_trusted_certificate) (containing the chain of intermediate certificates) must also be set!

Verify that OCSP stapling works:

```

openssl s_client -connect example.com:443 -tls1_2  -tlsextdebug  -status | grep -i "OCSP Response"

```