Page MenuHomeDevCentral
Files F10676358

D3638.diff
No OneTemporary
Actions

D3638.diff
View Options

diff --git a/Makefile b/Makefile
--- a/Makefile
+++ b/Makefile
@@ -31,18 +31,13 @@
# Build targets - repository
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-repo: roles/webserver-core/nginx/files/ocsp-ca-certs.pem \
- .git/hooks/pre-commit
-
-roles/webserver-core/nginx/files/ocsp-ca-certs.pem:
- utils/generate-ocsp-bundle.sh > roles/webserver-core/nginx/files/ocsp-ca-certs.pem
+repo: .git/hooks/pre-commit
.git/hooks/pre-commit:
pre-commit install
clean-repo:
${RM} .git/hooks/pre-commit
- ${RM} roles/webserver-core/nginx/files/ocsp-ca-certs.pem
# -------------------------------------------------------------
# Build targets - API
diff --git a/roles/webserver-core/nginx/config.sls b/roles/webserver-core/nginx/config.sls
--- a/roles/webserver-core/nginx/config.sls
+++ b/roles/webserver-core/nginx/config.sls
@@ -81,22 +81,6 @@
- name: openssl dhparam -out {{ dirs.etc }}/nginx/dhparams.pem 4096
- creates: {{ dirs.etc }}/nginx/dhparams.pem
-# -------------------------------------------------------------
-# OCSP - Online Certificate Status Protocol
-#
-# To allow nginx to verify TLS certificate presented by CA
-# when it makes requests to the CRL, a bundle of CA certificates
-# should be available.
-#
-# To generate the bundle file on this repository, use `make`.
-# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-
-/usr/local/share/certs/ocsp-ca-certs.pem:
- file.managed:
- - source: salt://roles/webserver-core/nginx/files/ocsp-ca-certs.pem
- - makedirs: True
- - mode: 644
-
# -------------------------------------------------------------
# Logs
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
diff --git a/roles/webserver-core/nginx/files/includes/tls b/roles/webserver-core/nginx/files/includes/tls
--- a/roles/webserver-core/nginx/files/includes/tls
+++ b/roles/webserver-core/nginx/files/includes/tls
@@ -49,24 +49,3 @@
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
add_header Strict-Transport-Security "max-age=63072000" always;
-
-# -------------------------------------------------------------
-# OCSP - Online Certificate Status Protocol
-#
-# To improve TLS handshake speed, and to help protecting the
-# privacy of the users connecting here, as there isn't any need
-# for them to connect to the CRL anymore, OSCP is enabled.
-#
-# The parameter `ssl_trusted_certificate` points to a bundle
-# of CA certificates, currently containing Let's Encrypt
-# intermediate and root certificates. If *any* certificate
-# is issued by another CA, their certificates must be added
-# to the bundle too.
-# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-
-ssl_stapling on;
-ssl_stapling_verify on;
-
-ssl_trusted_certificate /usr/local/share/certs/ocsp-ca-certs.pem;
-
-resolver 127.0.0.1;
diff --git a/roles/webserver-core/nginx/files/includes/tls-modern-only b/roles/webserver-core/nginx/files/includes/tls-modern-only
--- a/roles/webserver-core/nginx/files/includes/tls-modern-only
+++ b/roles/webserver-core/nginx/files/includes/tls-modern-only
@@ -46,24 +46,3 @@
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
add_header Strict-Transport-Security "max-age=63072000" always;
-
-# -------------------------------------------------------------
-# OCSP - Online Certificate Status Protocol
-#
-# To improve TLS handshake speed, and to help protecting the
-# privacy of the users connecting here, as there isn't any need
-# for them to connect to the CRL anymore, OSCP is enabled.
-#
-# The parameter `ssl_trusted_certificate` points to a bundle
-# of CA certificates, currently containing Let's Encrypt
-# intermediate and root certificates. If *any* certificate
-# is issued by another CA, their certificates must be added
-# to the bundle too.
-# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-
-ssl_stapling on;
-ssl_stapling_verify on;
-
-ssl_trusted_certificate /usr/local/share/certs/ocsp-ca-certs.pem;
-
-resolver 127.0.0.1;
diff --git a/utils/generate-ocsp-bundle.sh b/utils/generate-ocsp-bundle.sh
deleted file mode 100755
--- a/utils/generate-ocsp-bundle.sh
+++ /dev/null
@@ -1,41 +0,0 @@
-#!/bin/sh
-
-# -------------------------------------------------------------
-# rOPS — generate OCSP bundle with CA certificates
-# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-# Project: Nasqueron
-# License: Trivial work, not eligible to copyright
-# -------------------------------------------------------------
-
-# -------------------------------------------------------------
-# Let's encrypt
-#
-# Active certificates:
-# - Let’s Encrypt R10 - signed by ISRG Root X1
-# - Let’s Encrypt R11 - signed by ISRG Root X1
-# - Let’s Encrypt E5 - signed by ISRG Root X1 and X2
-# - Let’s Encrypt E6 - signed by ISRG Root X1 and X2
-#
-# Backup certificates:
-# - Let’s Encrypt R12 - signed by ISRG Root X1
-# - Let’s Encrypt R13 - signed by ISRG Root X1
-# - Let’s Encrypt R14 - signed by ISRG Root X1
-# - Let’s Encrypt E7 - signed by ISRG Root X1 and X2
-# - Let’s Encrypt E8 - signed by ISRG Root X1 and X2
-# - Let’s Encrypt E9 - signed by ISRG Root X1 and X2
-# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-
-curl -sS https://letsencrypt.org/certs/2024/r10.pem
-curl -sS https://letsencrypt.org/certs/2024/r11.pem
-curl -sS https://letsencrypt.org/certs/2024/r12.pem
-curl -sS https://letsencrypt.org/certs/2024/r13.pem
-curl -sS https://letsencrypt.org/certs/2024/r14.pem
-
-curl -sS https://letsencrypt.org/certs/2024/e5.pem
-curl -sS https://letsencrypt.org/certs/2024/e6.pem
-curl -sS https://letsencrypt.org/certs/2024/e7.pem
-curl -sS https://letsencrypt.org/certs/2024/e8.pem
-curl -sS https://letsencrypt.org/certs/2024/e9.pem
-
-curl -sS https://letsencrypt.org/certs/isrg-root-x1-cross-signed.pem
-curl -sS https://letsencrypt.org/certs/isrg-root-x2-cross-signed.pem

File Metadata

Mime Type
text/plain
Expires
Thu, Jul 24, 04:05 (10 h, 37 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
2839540
Default Alt Text
D3638.diff (5 KB)

Event Timeline

Nasqueron DevCentral · If it had been much bigger the moon would have had a core of ice. · Powered by Phabricator