Page MenuHomeDevCentral
Files F10341293

D3637.id9405.diff
No OneTemporary
Actions

D3637.id9405.diff
View Options

diff --git a/Makefile b/Makefile
--- a/Makefile
+++ b/Makefile
@@ -34,9 +34,6 @@
repo: roles/webserver-core/nginx/files/ocsp-ca-certs.pem \
.git/hooks/pre-commit
-roles/webserver-core/nginx/files/ocsp-ca-certs.pem:
- utils/generate-ocsp-bundle.sh > roles/webserver-core/nginx/files/ocsp-ca-certs.pem
-
.git/hooks/pre-commit:
pre-commit install
diff --git a/roles/webserver-core/nginx/config.sls b/roles/webserver-core/nginx/config.sls
--- a/roles/webserver-core/nginx/config.sls
+++ b/roles/webserver-core/nginx/config.sls
@@ -81,22 +81,6 @@
- name: openssl dhparam -out {{ dirs.etc }}/nginx/dhparams.pem 4096
- creates: {{ dirs.etc }}/nginx/dhparams.pem
-# -------------------------------------------------------------
-# OCSP - Online Certificate Status Protocol
-#
-# To allow nginx to verify TLS certificate presented by CA
-# when it makes requests to the CRL, a bundle of CA certificates
-# should be available.
-#
-# To generate the bundle file on this repository, use `make`.
-# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-
-/usr/local/share/certs/ocsp-ca-certs.pem:
- file.managed:
- - source: salt://roles/webserver-core/nginx/files/ocsp-ca-certs.pem
- - makedirs: True
- - mode: 644
-
# -------------------------------------------------------------
# Logs
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
diff --git a/roles/webserver-core/nginx/files/includes/tls b/roles/webserver-core/nginx/files/includes/tls
--- a/roles/webserver-core/nginx/files/includes/tls
+++ b/roles/webserver-core/nginx/files/includes/tls
@@ -56,17 +56,9 @@
# To improve TLS handshake speed, and to help protecting the
# privacy of the users connecting here, as there isn't any need
# for them to connect to the CRL anymore, OSCP is enabled.
-#
-# The parameter `ssl_trusted_certificate` points to a bundle
-# of CA certificates, currently containing Let's Encrypt
-# intermediate and root certificates. If *any* certificate
-# is issued by another CA, their certificates must be added
-# to the bundle too.
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ssl_stapling on;
ssl_stapling_verify on;
-ssl_trusted_certificate /usr/local/share/certs/ocsp-ca-certs.pem;
-
resolver 127.0.0.1;
diff --git a/roles/webserver-core/nginx/files/includes/tls-modern-only b/roles/webserver-core/nginx/files/includes/tls-modern-only
--- a/roles/webserver-core/nginx/files/includes/tls-modern-only
+++ b/roles/webserver-core/nginx/files/includes/tls-modern-only
@@ -53,17 +53,9 @@
# To improve TLS handshake speed, and to help protecting the
# privacy of the users connecting here, as there isn't any need
# for them to connect to the CRL anymore, OSCP is enabled.
-#
-# The parameter `ssl_trusted_certificate` points to a bundle
-# of CA certificates, currently containing Let's Encrypt
-# intermediate and root certificates. If *any* certificate
-# is issued by another CA, their certificates must be added
-# to the bundle too.
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ssl_stapling on;
ssl_stapling_verify on;
-ssl_trusted_certificate /usr/local/share/certs/ocsp-ca-certs.pem;
-
resolver 127.0.0.1;

File Metadata

Mime Type
text/plain
Expires
Tue, Jul 1, 20:09 (15 h, 40 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
2779239
Default Alt Text
D3637.id9405.diff (3 KB)

Event Timeline

Nasqueron DevCentral · If it had been much bigger the moon would have had a core of ice. · Powered by Phabricator