Hello!

On Thu, Oct 13, 2016 at 12:25:44PM +0200, rainer@ultra-secure.de wrote:

> Hi,
>
> we have been informed by our CA that they will be moving their OCSP-servers
> to "the cloud" - it was a fixed set of IPs before.
> These fixed sets could relatively easily be entered as firewall rules (and
> hosts-file entries, should DNS-resolution be unavailable).
> Of course, they could as easily be targeted by Script-Kiddies and
> Wannabe-Hackers as targets for a DDoS.
>
> As such, I would need to allow outbound http-connections to the whole
> internet, which is kind of exactly the opposite of what I want to do.
> And that's ignoring for a moment the necessity to allow outbound DNS...
>
> It would be cool if nginx would be able to do the stapling through a
> http-proxy.

OCSP stapling allows you to:

- provide your own file to staple using ssl_stapling_file
directive. It doesn't matter for nginx how the file was
obtained. You can even update it by hand. It might be
relatively straightforward to configure automatic updating
process though. See http://nginx.org/r/ssl_stapling_file for details.

- use an explicitly configured OCSP responder with the
ssl_stapling_responder directive. It allows to configure your
own OCSP responder at a fixed address, and then proxy requests to
the real responder. See http://nginx.org/r/ssl_stapling_responder
for details.

--
Maxim Dounin
http://nginx.org/

_______________________________________________
nginx mailing list
nginx@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx