diff options
| author | Guilhem Moulin <guilhem@fripost.org> | 2025-08-06 13:51:50 +0200 |
|---|---|---|
| committer | Guilhem Moulin <guilhem@fripost.org> | 2025-08-06 13:51:50 +0200 |
| commit | 983981b8546d9ef847cfef7711c35c6e06549f43 (patch) | |
| tree | ba371c55b3e79d5a7e414accbd13771d3c2cfa5f | |
| parent | 39b0e7d580831b09e63a51196fdf8c89180abf7f (diff) | |
Nginx: Drop OCSP stapling directives.
Let's Encrypt removed OCSP URLs from certificates on 2025-05-07, see
https://letsencrypt.org/2024/12/05/ending-ocsp .
| -rw-r--r-- | roles/common-web/files/etc/nginx/snippets/ssl.conf | 8 |
1 files changed, 0 insertions, 8 deletions
diff --git a/roles/common-web/files/etc/nginx/snippets/ssl.conf b/roles/common-web/files/etc/nginx/snippets/ssl.conf index 0284b0a..58adece 100644 --- a/roles/common-web/files/etc/nginx/snippets/ssl.conf +++ b/roles/common-web/files/etc/nginx/snippets/ssl.conf @@ -16,11 +16,3 @@ ssl_prefer_server_ciphers off; # HSTS (ngx_http_headers_module is required) (31557600 seconds = 1 year) add_header Strict-Transport-Security "max-age=31557600; includeSubDomains" always; - -# OCSP Stapling: fetch OCSP records from URL in ssl_certificate and cache them -# https://github.com/jsha/ocsp-stapling-examples/blob/master/nginx.conf -ssl_stapling on; -ssl_stapling_verify on; - -# verify chain of trust of OCSP response using Root CA and Intermediate certs -ssl_trusted_certificate /usr/share/lacme/ca-certificates.crt; |