Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

nixos/nginx: ensure TLS OCSP stapling works out of the box with LE #45810

Merged
merged 1 commit into from Aug 31, 2018
Merged

nixos/nginx: ensure TLS OCSP stapling works out of the box with LE #45810

merged 1 commit into from Aug 31, 2018

Conversation

vincentbernat
Copy link
Member

Motivation for this change

The recommended TLS configuration comes with ssl_stapling on and
ssl_stapling_verify on. However, this last directive also requires
the use of ssl_trusted_certificate to verify the received answer.
When using enableACME or similar, we can help the user by providing
the correct value for the directive.

The result can be tested with:

openssl s_client -connect web.example.com:443 -status 2> /dev/null

Without OCSP stapling, we get:

OCSP response: no response sent

After this change, we get:

OCSP Response Data:
    OCSP Response Status: successful (0x0)
    Response Type: Basic OCSP Response
    Version: 1 (0x0)
    Responder Id: C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
    Produced At: Aug 30 20:46:00 2018 GMT
Things done
  • Tested in a NixOS VM (should I use sandboxing?)
  • Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS)
  • Built on platform(s)
    • NixOS
    • macOS
    • other Linux distributions
  • Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
  • Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
  • Tested execution of all binary files (usually in ./result/bin/)
  • Determined the impact on package closure size (by running nix path-info -S before and after)
  • Fits CONTRIBUTING.md.

@vincentbernat
nixos/nginx: ensure TLS OCSP stapling works out of the box with LE
1251b34 
The recommended TLS configuration comes with `ssl_stapling on` and
`ssl_stapling_verify on`. However, this last directive also requires
the use of `ssl_trusted_certificate` to verify the received answer.
When using `enableACME` or similar, we can help the user by providing
the correct value for the directive.

The result can be tested with:

    openssl s_client -connect web.example.com:443 -status 2> /dev/null

Without OCSP stapling, we get:

    OCSP response: no response sent

After this change, we get:

    OCSP Response Data:
        OCSP Response Status: successful (0x0)
        Response Type: Basic OCSP Response
        Version: 1 (0x0)
        Responder Id: C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
        Produced At: Aug 30 20:46:00 2018 GMT
@Mic92 Mic92 requested a review from fpletz August 31, 2018 07:08
@fpletz fpletz merged commit 1cc916b into NixOS:master Aug 31, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@fpletz fpletz fpletz approved these changes

Assignees
No one assigned
Labels
6.topic: nixos 8.has: module (update) 10.rebuild-darwin: 0 10.rebuild-linux: 0
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
3 participants
@vincentbernat @fpletz @GrahamcOfBorg