Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 14, 05:15 UTC
caddytls: Disable OCSP stapling for manual certs (#4064)
Matthew Holt committed
Apr 12, 2021 at 16:09 UTC
2250920e1d8506991c97275f1e517e1189c20a2f
1 file changed
+13
modules/caddytls/tls.go
+13
@@ -56,6 +56,16 @@ type TLS struct {
56
// Configures the in-memory certificate cache.
57
Cache *CertCacheOptions `json:"cache,omitempty"`
58
59
+ // Disables OCSP stapling for manually-managed certificates only.
60
+ // To configure OCSP stapling for automated certificates, use an
61
+ // automation policy instead.
62
+ //
63
+ // Disabling OCSP stapling puts clients at greater risk, reduces their
64
+ // privacy, and usually lowers client performance. It is NOT recommended
65
+ // to disable this unless you are able to justify the costs.
66
+ // EXPERIMENTAL. Subject to change.
67
+ DisableOCSPStapling bool `json:"disable_ocsp_stapling,omitempty"`
68
+
69
certificateLoaders []CertificateLoader
70
automateNames []string
71
certCache *certmagic.Cache
@@ -173,6 +183,9 @@ func (t *TLS) Provision(ctx caddy.Context) error {
183
magic := certmagic.New(t.certCache, certmagic.Config{
184
Storage: ctx.Storage(),
185
Logger: t.logger,
186
+ OCSP: certmagic.OCSPConfig{
187
+ DisableStapling: t.DisableOCSPStapling,
188
+ },
189
})
190
for _, loader := range t.certificateLoaders {
191
certs, err := loader.LoadCertificates()