Formed in 2009, the Archive Team (not to be confused with the archive.org Archive-It Team) is a rogue archivist collective dedicated to saving copies of rapidly dying or deleted websites for the sake of history and digital heritage. The group is 100% composed of volunteers and interested parties, and has expanded into a large amount of related projects for saving online and digital history.
Join GitHub today
GitHub is home to over 50 million developers working together to host and review code, manage projects, and build software together.
Sign upGitHub is where the world builds software
Millions of developers and companies build, ship, and maintain their software on GitHub — the largest and most advanced development platform in the world.
ocsp: respond "unauthorized" for expired OCSP #4338
Closed
Assignees
Labels
Comments
rolandshoemaker
added a commit
that referenced
this issue
Aug 1, 2019
The ocsp-updater ocspStaleMaxAge config var has to be bumped up to ~7 months so that when it is run after the six-months-ago run it will actually update the ocsp responses generated during that period and mark the certificate status row as expired. Fixes #4338.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Right now we don't clean up expired OCSP responses from the database right away. That means that if someone queries OCSP after a certificate is expired, they might get an expired OCSP response. This is technically fine since there's no requirement to maintain OCSP responses for expired certificates, but has caused confusion at least once: https://community.letsencrypt.org/t/invalid-ocsp-response-nextupdate-is-in-the-past/95640/6.
It would be nice for our OCSP responded to check the expiration on responses, and respond with "unauthorized" right away, rather than waiting until those responses are cleaned up.