https://github.com/stustanet/ocsp-forwarder
https://github.com/stustanet/ocsp-forwarder
nginx ocsp ocsp-proxy ocsp-staple ocsp-stapling
Last synced: about 2 months ago
JSON representation
- Host: GitHub
- URL: https://github.com/stustanet/ocsp-forwarder
- Owner: stustanet
- License: mit
- Created: 2018-04-25T19:32:54.000Z (about 8 years ago)
- Default Branch: master
- Last Pushed: 2022-04-22T18:17:17.000Z (about 4 years ago)
- Last Synced: 2025-10-30T18:28:06.831Z (8 months ago)
- Topics: nginx, ocsp, ocsp-proxy, ocsp-staple, ocsp-stapling
- Language: Go
- Homepage: https://gitlab.stusta.de/stustanet/ocsp-forwarder
- Size: 19.5 KB
- Stars: 2
- Watchers: 5
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# OCSP Forwarder
A workaround for web servers without HTTP proxy support for OCSP requests to use an HTTP proxy nonetheless.
## Setup
```sh
# add system user for OCSP Forwarder
useradd --system -s /bin/false -M ocsp-forwarder
# Make sure that Go and git are installed. For Debian Stretch:
apt install git
apt install -t stretch-backports golang
# install go package
GOPATH=/usr/local/src/go GOBIN=/usr/local/bin go get github.com/stustanet/ocsp-forwarder
# install and start systemd service
cp /usr/local/src/go/src/github.com/stustanet/ocsp-forwarder/systemd/ocsp-forwarder.service /etc/systemd/system/
# edit /etc/systemd/system/ocsp-forwarder.service
systemctl enable --now ocsp-forwarder.service
```
Adjust the parameters in the `/etc/systemd/system/ocsp-forwarder.service` as nedeed. For Let's Encrypt X3 certificates the `responder_url` is `http://r3.o.lencr.org/`.
In the nginx config (server block):
```
ssl_stapling_responder http://127.0.0.1:8234;
```
[`ssl_trusted_certificate`](https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_trusted_certificate) (containing the chain of intermediate certificates) must also be set!
Verify that OCSP stapling works:
```
openssl s_client -connect example.com:443 -tls1_2 -tlsextdebug -status | grep -i "OCSP Response"
```