You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@trafficserver.apache.org by jp...@apache.org on 2015/10/09 05:20:48 UTC
[1/2] trafficserver git commit: Added proxy.config.ssl.ocsp
configuration directives.
Repository: trafficserver
Updated Branches:
refs/heads/master 0b6244a5a -> a2328d635
Added proxy.config.ssl.ocsp configuration directives.
Project: http://git-wip-us.apache.org/repos/asf/trafficserver/repo
Commit: http://git-wip-us.apache.org/repos/asf/trafficserver/commit/fbf5c661
Tree: http://git-wip-us.apache.org/repos/asf/trafficserver/tree/fbf5c661
Diff: http://git-wip-us.apache.org/repos/asf/trafficserver/diff/fbf5c661
Branch: refs/heads/master
Commit: fbf5c6611e277f4e6e9d095f2022665cc12c85f6
Parents: 0b6244a
Author: Steven Feltner <sf...@godaddy.com>
Authored: Thu Oct 8 14:51:25 2015 -0700
Committer: James Peach <jp...@apache.org>
Committed: Thu Oct 8 20:15:53 2015 -0700
----------------------------------------------------------------------
.../configuration/records.config.en.rst | 26 ++++++++++++++++++--
1 file changed, 24 insertions(+), 2 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/trafficserver/blob/fbf5c661/doc/reference/configuration/records.config.en.rst
----------------------------------------------------------------------
diff --git a/doc/reference/configuration/records.config.en.rst b/doc/reference/configuration/records.config.en.rst
index 845580d..9a61511 100644
--- a/doc/reference/configuration/records.config.en.rst
+++ b/doc/reference/configuration/records.config.en.rst
@@ -2585,6 +2585,28 @@ Client-Related Configuration
Specifies the location of the certificate authority file against
which the origin server will be verified.
+OCSP Stapling Configuration
+===========================
+
+.. ts:cv:: CONFIG proxy.config.ssl.ocsp.enabled INT 0
+
+ Enable OCSP stapling.
+
+ - ``0`` = disables OCSP Stapling
+ - ``1`` = allows Traffic Server to request SSL certificate revocation status from an OCSP responder.
+
+.. ts:cv:: CONFIG proxy.config.ssl.ocsp.cache_timeout INT 3600
+
+ Number of seconds before an OCSP response expires in the stapling cache.
+
+.. ts:cv:: CONFIG proxy.config.ssl.ocsp.request_timeout INT 10
+
+ Timeout (in seconds) for queries to OCSP responders.
+
+.. ts:cv:: CONFIG proxy.config.ssl.ocsp.update_period INT 60
+
+ Update period (in seconds) for stapling caches.
+
ICP Configuration
=================
@@ -2948,11 +2970,11 @@ Value Effect
2 Do not accept inbound connections until cache initialization has finished and been sufficiently
successful that cache is enabled. This means at least one cache span is usable. If there are no
- spans in :configfile:`storage.config` or none of the spans can be successfully parsed and
+ spans in :file:`storage.config` or none of the spans can be successfully parsed and
initialized then Traffic Server will shut down.
3 Do not accept inbound connections until cache initialization has finished and been completely
- successful. This requires at least one cache span in :configfile:`storage.config` and that every
+ successful. This requires at least one cache span in :file:`storage.config` and that every
span specified is valid and successfully initialized. Any error will cause Traffic Server to shut
down.
===== ====================
[2/2] trafficserver git commit: Added OCSP Stapling admin section.
Posted by jp...@apache.org.
Added OCSP Stapling admin section.
This closes #303
Project: http://git-wip-us.apache.org/repos/asf/trafficserver/repo
Commit: http://git-wip-us.apache.org/repos/asf/trafficserver/commit/a2328d63
Tree: http://git-wip-us.apache.org/repos/asf/trafficserver/tree/a2328d63
Diff: http://git-wip-us.apache.org/repos/asf/trafficserver/diff/a2328d63
Branch: refs/heads/master
Commit: a2328d635caaedc7875c911b91bcdd7c8ab0f90e
Parents: fbf5c66
Author: Steven Feltner <sf...@godaddy.com>
Authored: Thu Oct 8 14:51:58 2015 -0700
Committer: James Peach <jp...@apache.org>
Committed: Thu Oct 8 20:20:06 2015 -0700
----------------------------------------------------------------------
doc/admin/security-options.en.rst | 48 ++++++++++++++++++++++++++++++++++
1 file changed, 48 insertions(+)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/trafficserver/blob/a2328d63/doc/admin/security-options.en.rst
----------------------------------------------------------------------
diff --git a/doc/admin/security-options.en.rst b/doc/admin/security-options.en.rst
index 659facd..c93854c 100644
--- a/doc/admin/security-options.en.rst
+++ b/doc/admin/security-options.en.rst
@@ -275,3 +275,51 @@ a ticket key file as a reverse queue in 48-byte chunks.
#. Touch :file:`ssl_multicert.config` to indicate that the SSL configuration is stale.
#. Run the command :option:`traffic_ctl config reload` to apply the new ticket key.
+
+OCSP Stapling
+============================================
+
+OCSP Stapling is an alternative approach to checking the revocation
+status of an SSL certificate using the Online Certificate Status
+Protocol.
+
+Under the original OCSP implementation, clients requested a
+certificate's revocation status directly from the Certificate
+Authority (CA) that issued the certificate. This could cause
+significant load on the CA servers since they were required to
+provide a response to every client of a given certificate in real
+time.
+
+Enabling OCSP Stapling instructs Traffic Server to retrieve and cache the
+revocation status of all configured SSL certificates, and present them to the
+client when the client requests the status. Traffic Server will automatically
+query the OCSP responder specified in the SSL certificate to gather the latest
+revocation status. Traffic Server will then cache the results for each
+configured certifcate. The location of the OCSP responder is taken from the
+Authority Information Access field of the signed certificate. For example::
+
+ Authority Information Access:
+ OCSP - URI:http://ocsp.digicert.com
+ CA Issuers - URI:http://cacerts.digicert.com/DigiCertSHA2SecureServerCA.crt
+
+Support for OCSP Stapling can be tested using the -status option of the OpenSSL client::
+
+ $ openssl s_client -connect mozillalabs.com:443 -status
+ ...
+ ======================================
+ OCSP Response Data:
+ OCSP Response Status: successful (0x0)
+ Response Type: Basic OCSP Response
+ Version: 1 (0x0)
+ ...
+
+Details of the OCSP Stapling TLS extension can be found in :rfc:`6961`.
+
+To configure Traffic Server to use OCSP Stapling, edit the following variables
+in :file:`records.config` file:
+
+* :ts:cv:`proxy.config.ssl.ocsp.enabled`
+* :ts:cv:`proxy.config.ssl.ocsp.cache_timeout`
+* :ts:cv:`proxy.config.ssl.ocsp.request_timeout`
+* :ts:cv:`proxy.config.ssl.ocsp.update_period`
+