tomwassenberg/certbot-ocsp-fetcher

A tool that primes the OCSP cache of nginx for certificates managed by Certbot, in order to make OCSP stapling work reliably.

certbot-ocsp-fetcher's Issues

Add CLI parameter to specify custom Certbot directory

This is now hardcoded as /etc/letsencrypt, while it can be different if a Certbot user uses a non-standard directory.

Account for Certbot dir and output dir that start with a hyphen

The command calls that take $CERTBOT_DIR and $OUTPUT_DIR as a parameter will now fail if any of these variables start with a hyphen, because those will assume they are flags instead of values.

Only replace old staple *after* validating cert status, not before

Probably requires a temp file.

Mention "certbot --nginx --staple-ocsp" in README

Check for status of certificate

A certificate should normally never be in a "revoked" status, while still being present in Certbot's folder. So when the script encounters such a certificate, the script should halt and/or send an alert.

Add systemd service + timer

This is useful, because this script should be run periodically, since OCSP responses are valid for a maximum of 10 days, and a new response should be issued at least every 4 days.

Add parameter to specify cert lineage

Docker image?

Hi there. Thank you for this immensely useful tool, it really should be more well-known.
Currently, the only way to use it is to just manually take the script file that's found in the repo and put it where you want and execute it. You also have to also make sure that the dependencies are in place.

It would be nice though if you also published a Docker image to Docker Hub.

Let me know if this is somehow not feasible.

Thanks.

Add check for correct OpenSSL syntax

Because of a backwards-incompatible argument style change in OpenSSL 1.1.0, the current OpenSSL command that fetches the actual OCSP response doesn't work on OpenSSL <1.1.0.

I should check what OpenSSL version is on the system, and use the correct argument style for it.

Add "-h/--help" flag

This should print the usage and exit with success.

Do research on exit codes of openssl command

I should check when the openssl ocsp command exits with exit code 0, and when it exits with another exit code. In this way, errors can be caught.

Message "Running as a deploy hook of Certbot" shown as error in certbot renew

Renewing an existing certificate for example.com and *.example.com

Hook 'deploy-hook' ran with output:
 example.com	updated
Hook 'deploy-hook' ran with error output:
 Running as a deploy hook of Certbot...

 LINEAGE   	RESULT 	REASON

Sounds like the message " Running as a deploy hook of Certbot..." is seen as an error message by certbot renew.
And " LINEAGE RESULT REASON" as well.

Therefore, I uncommented the lines in your code that print these two messages detected as error messages.

But even, after that, I get the "error" message:

"Hook 'deploy-hook' ran with error output:
 example.com	updated"

Add CLI parameter to specify custom output directory

The directory where OCSP responses are saved is now hardcoded as /etc/nginx/ocsp-cache. This should be configurable.

CLI parameter to specify a custom certificate to process

In "manual mode", you might not be using Certbot at all, so a way to specify the certificate(s) to process would be nice.

Make it possible to run as non-root

The check for root privileges should be conditional, so the script only halts if it actually needs root for the tasks it's about to perform. So if:

• your certificate chains are readable by the current user, AND
• the output directory is writeable by the current user, AND
• nginx can be restarted by the current user

you wouldn't actually need root.

Only re-fetch when "Next Update" date is due

Blocked on #13.

Make tool output more "Unixy"

This article lists some good design practices for Unix tools, especially regarding the output. I should check if there is stuff that can be used here.

Explain/link to how to configure OCSP stapling in nginx