ocsp_peer
Verify the peer's certificate against its OCSP responder and reject revoked certificates. Set an object to tune the checks.
Types
| Type | Description | Choices |
|---|---|---|
boolean | true, false | |
object | An object with a set of explicit properties that can be set. | - |
Properties
| Name | Description | Type | Default | Reloadable |
|---|---|---|---|---|
verify | Enable OCSP revocation checking of the peer's certificate. | boolean | false | Yes |
ca_timeout | How long to wait for the OCSP responder. | duration | 2s | Yes |
allowed_clockskew | Clock skew tolerated when checking responder timestamps. | duration | 30s | Yes |
unknown_is_good | Treat an unknown response from the responder as good. | boolean | false | Yes |
warn_only | Log revocation failures instead of rejecting the connection. | boolean | false | Yes |
cache_ttl_when_next_update_unset | How long to cache a response that carries no next-update time. | duration | 1h | Yes |