Egothor/ZeroEcho
2
0
Fork 0
Code Issues 15 Pull Requests Actions Packages Projects 1 Releases 4 Wiki Activity

feat(pki-server): add OCSP responder and close server release

Browse Source 
Add durable multi-authority OCSP responders with strict request parsing,
issuer-bound serial lookup, stable revocation views, signed responses,
nonce policies and bounded protocol execution.

Complete in-process and packaged OCSP validation and close the PKI server
after the final architecture, security and release audit.
This commit is contained in:
Leo Galambos
2026-08-05 18:32:00 +02:00
parent b19edf17fd
commit 44cbb0a37d
38 changed files with 2831 additions and 107 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
docs/pki-server-acme.md
View File

@@ -8,7 +8,7 @@ An ACME directory is an immutable policy revision bound to one realm, logical au
Direct deployments use server-authenticated TLS. A client TLS certificate is not ACME account authority; ACME identity is the account key authenticated by JWS. Trusted-reverse-proxy deployments require the established mutually authenticated proxy-to-ZeroEcho TLS hop and a dedicated enabled proxy principal with `FORWARD_AUTHENTICATED_CLIENT_IDENTITY`. Forwarded administrative identity is not used as an ACME account. Source addresses and `Forwarded` or `X-Forwarded-*` headers never authorize ACME.
The server configuration schema is version 4. ACME is disabled explicitly with:
The server configuration schema is version 5. ACME is disabled explicitly with:
```json
"acmeListener": {"enabled": false}