Egothor/ZeroEcho
2
0
Fork 0
Code Issues 15 Pull Requests Actions Packages Projects 1 Releases 4 Wiki Activity

feat(pki-server): add OCSP responder and close server release

Browse Source 
Add durable multi-authority OCSP responders with strict request parsing,
issuer-bound serial lookup, stable revocation views, signed responses,
nonce policies and bounded protocol execution.

Complete in-process and packaged OCSP validation and close the PKI server
after the final architecture, security and release audit.
This commit is contained in:
Leo Galambos
2026-08-05 18:32:00 +02:00
parent b19edf17fd
commit 44cbb0a37d
38 changed files with 2831 additions and 107 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
pki-server/src/main/java/zeroecho/pki/server/ServerOperationGateway.java
View File

@@ -190,6 +190,8 @@ public final class ServerOperationGateway {
/** Installs the optional configured ACME control capability once before listener readiness. */
public void installAcme(AcmeService service) { controlExecutor.installAcme(service); }
/** Installs the realm-owned OCSP administration capability before readiness. */
public void installOcsp(OcspResponderService service) { controlExecutor.installOcsp(service); }
/** Creates the pre-control-plane gateway surface for embedded source compatibility. */
public ServerOperationGateway(RealmId realmId, AuthorityExposurePolicy exposure, ServerControlStore control,
@@ -538,6 +540,19 @@ public final class ServerOperationGateway {
case ServerControlOperation.SetAcmeDirectoryActive value -> controlExecutor.acmeScope(value);
case ServerControlOperation.InspectAcmeAccount value -> controlExecutor.acmeScope(value);
case ServerControlOperation.DeactivateAcmeAccount value -> controlExecutor.acmeScope(value);
case ServerControlOperation.RegisterOcspResponder value -> new Permission.Scope(realmId,
Optional.of(value.registration().authorityId()), Optional.of(value.registration().issuerId()),
Optional.empty());
case ServerControlOperation.InspectOcspResponder value -> {
OcspResponderService.Responder responder = controlExecutor.ocspResponder(value.responderId());
yield new Permission.Scope(realmId, Optional.of(responder.authorityId()),
Optional.of(responder.issuerId()), Optional.empty());
}
case ServerControlOperation.SetOcspResponderActive value -> {
OcspResponderService.Responder responder = controlExecutor.ocspResponder(value.responderId());
yield new Permission.Scope(realmId, Optional.of(responder.authorityId()),
Optional.of(responder.issuerId()), Optional.empty());
}
default -> resource.scope();
};
if (!actual.equals(resource.scope())) throw new SecurityException("Control scope differs");