Changeset e1c094c in mod_gnutls for test/tests/27_OCSP_server

Timestamp:

Nov 14, 2016, 2:12:53 PM (3 years ago)

Author:

Thomas Klute <thomas2.klute@…>

Branches:

debian/master, debian/stretch-backports, master, upstream

Children:

9a18e30

Parents:

b26a792

Message:

Replace GnuTLSOCSPGraceTime with GnuTLSOCSPCacheTimeout

Configuring a timeout instead a time relative to the nextUpdate field
of the OCSP response has two main advantages:

• The maximum cache lifetime is independent of any external data. The OCSP response is signed and the CA generally a trusted entity, but its policy is almost always outside the server admin's control and might change.

• The principle is a lot simpler and thus less likely to lead to implementation or configuration errors.

Additionally a static timeout policy should make it easier to
implement asynchronous cache updates for MPMs that support it.

File:

• test/tests/27_OCSP_server/apache.conf (modified) (1 diff)

test/tests/27_OCSP_server/apache.conf

@@ -9 +9 @@
         GnuTLSEnable            On
         GnuTLSOCSPStapling      On
+        GnuTLSOCSPCacheTimeout  60
         GnuTLSCertificateFile   server/x509-chain.pem
         GnuTLSKeyFile           server/secret.key