puppetlabs/puppet — pull request #510 by masterzen (2012-02-16 19:00:51+00:00)
Title: #10111 - Puppet should do OCSP instead of CRL

Hi,

Please find my attempt at bringing OCSP to Puppet. This time based on current master.

OCSP is a way for a node in an X509 PKI to check the validity of a peer certificate. For this, the node sends to a 3rd party an OCSP request, the 3rd party (usually the CA) checks the certificate and returns an OCSP response.

In the Puppet ecosystem, the Puppet CA acts as the OCSP responder. It receives OCSP requests sent through REST at the ocsp indirection, checks the certificate status in the CA CRL and returns an OCSP response (in a YAML format because that's the only way it could work). OCSP has no interest in terms of security if the master is also the CA.

The OCSP verification can be enabled on both the client and the server. On the client side, all the server certificate chain is verified against the OSCP responder. On the server, only the current client certificate is checked. On non-webrick servers, the SSL endpoint should be configured to forward (usually as an http header) the client certificate if OCSP verification is enabled server side (check the commit message for instructions).

OCSP is enabled with the configuration settings --ocsp_verification.

The OCSP verifier contains a cache to not abuse the OCSP responder on every requests (the cache entries expires after --ocsp_ttl (usually 3600).

Note: I was unable to test with a passenger setup. Although I believe the passenger-only code is correct, it's possible that it might be buggy.

Note2: There is no caching in the CRL check. And the CRL check is sequential. This might be a performance issue for large CRL.

Note3: I'm closing the previous #233 pull request in favor of this one.

Thanks,