gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nixos/h2o: disable OCSP stapling w/ Let’s Encrypt (support sunset)

Browse Source 
It was noted in the TLS recommendations comment, but it actually should
be disabled everywhere if ACME is used as H2O has in enabled by default.

More info: <https://letsencrypt.org/2024/12/05/ending-ocsp/>
This commit is contained in:
โทสฺตัล
2025-03-29 12:31:46 +07:00
parent 54c581046b
commit 0c67557015
1 changed files with 27 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nixos/modules/services/web-servers/h2o/default.nix
+27 -18
View File
@@ -165,25 +165,34 @@ let
hasTLSRecommendations = tlsRecommendations != null && mozTLSRecs != null;
# NOTE: Let’s Encrypt has sunset OCSP stapling. Mozilla’s
# ssl-config-generator is at present still recommending this setting, but
# this module will skip setting a stapling value as Let’s Encrypt +
# ACME is the most likely use case.
#
# See: https://github.com/mozilla/ssl-config-generator/issues/323
tlsRecAttrs = lib.optionalAttrs hasTLSRecommendations (
let
recs = mozTLSRecs.${tlsRecommendations};
in
{
min-version = builtins.head recs.tls_versions;
cipher-preference = "server";
"cipher-suite-tls1.3" = recs.ciphersuites;
# ATTENTION: Let’s Encrypt has sunset OCSP stapling.
tlsRecAttrs =
# If using ACME, this module will disable H2O’s default OCSP
# stapling.
#
# See: https://letsencrypt.org/2024/12/05/ending-ocsp/
lib.optionalAttrs (builtins.elem names.cert certNames.all) {
ocsp-update-interval = 0;
}
// lib.optionalAttrs (recs.ciphers.openssl != [ ]) {
cipher-suite = lib.concatStringsSep ":" recs.ciphers.openssl;
}
);
# Mozilla’s ssl-config-generator is at present still
# recommending this setting as well, but this module will
# skip setting a stapling value as Let’s Encrypt + ACME is
# the most likely use case.
#
# See: https://github.com/mozilla/ssl-config-generator/issues/323
// lib.optionalAttrs hasTLSRecommendations (
let
recs = mozTLSRecs.${tlsRecommendations};
in
{
min-version = builtins.head recs.tls_versions;
cipher-preference = "server";
"cipher-suite-tls1.3" = recs.ciphersuites;
}
// lib.optionalAttrs (recs.ciphers.openssl != [ ]) {
cipher-suite = lib.concatStringsSep ":" recs.ciphers.openssl;
}
);
headerRecAttrs =
lib.optionalAttrs