From 07218fc1e6caf4299dd453744d6e9e53854f75ab Mon Sep 17 00:00:00 2001 From: Guilhem Moulin Date: Sat, 5 Dec 2020 15:50:33 +0100 Subject: nginx: Update trusted certificate used for OCSP stapling. See https://bugs.debian.org/975862 . --- roles/common-web/files/etc/nginx/snippets/ssl.conf | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/roles/common-web/files/etc/nginx/snippets/ssl.conf b/roles/common-web/files/etc/nginx/snippets/ssl.conf index 57a317b..0284b0a 100644 --- a/roles/common-web/files/etc/nginx/snippets/ssl.conf +++ b/roles/common-web/files/etc/nginx/snippets/ssl.conf @@ -1,9 +1,6 @@ # https://wiki.mozilla.org/Security/Server_Side_TLS # https://mozilla.github.io/server-side-tls/ssl-config-generator/?server=nginx-1.14.2&openssl=1.1.1c&hsts=yes&profile=intermediate -# certs sent to the client in SERVER HELLO are concatenated in ssl_certificate -# ~$ cat /etc/nginx/ssl/srvcert.pem /usr/share/lacme/lets-encrypt-x3-cross-signed.pem | sudo tee /etc/nginx/ssl/srvcert.chained.pem - ssl on; ssl_session_timeout 1d; @@ -26,4 +23,4 @@ ssl_stapling on; ssl_stapling_verify on; # verify chain of trust of OCSP response using Root CA and Intermediate certs -ssl_trusted_certificate /usr/share/lacme/lets-encrypt-x3-cross-signed.pem; +ssl_trusted_certificate /usr/share/lacme/ca-certificates.crt; -- cgit v1.2.3