{"commits":[{"author":{"name":"Brice Figureau","email":"c9103f7e92504f8408c832361c569d2cccc6caad@daysofwonder.com"},"sha":"718034fde3037bf0c98dd2e8d18d9eee4e46450a","message":"(#10111) - OCSP certificate verification\n\nThis commit adds the foundation layer of an OCSP responder for Puppet.\nIt also includes a puppet face to verify a given certificate\nstatus remotely through rest.\n\nThe verification of the certificate status is done with the actual\nCRL.\n\nSigned-off-by: Brice Figureau <brice-puppet@daysofwonder.com>","url":"https://api.github.com/repos/masterzen/puppet/commits/718034fde3037bf0c98dd2e8d18d9eee4e46450a"},{"author":{"name":"Brice Figureau","email":"c9103f7e92504f8408c832361c569d2cccc6caad@daysofwonder.com"},"sha":"e24b80befc88305acc0204fda1c7db9240ebf26b","message":"(#10111) - OCSP client verification\n\nThis patch adds client side OCSP certificate chain verification.\nThis happens for every connection made to the master.\nIt is recommended to run OCSP with a remote CA.\n\nNote: certificate verification status is not yet cached, this means\nthat an ocsp verification is done for every outbound request\nthe client does, which might prove to be slow.\n\nSigned-off-by: Brice Figureau <brice-puppet@daysofwonder.com>","url":"https://api.github.com/repos/masterzen/puppet/commits/e24b80befc88305acc0204fda1c7db9240ebf26b"},{"author":{"name":"Brice Figureau","email":"c9103f7e92504f8408c832361c569d2cccc6caad@daysofwonder.com"},"sha":"7b559b3938bf0f7eb8307519dc74af358dc3caab","message":"(#10111) - OCSP server checks\n\nThis commit adds client certificate OCSP verification in the server.\nThis makes sense only if the master is not a CA, in which case checking\nthe CRL directly would be way faster.\n\nTo do this the server needs to have access to the client certificate.\nThis is not a problem for webrick based setups because puppet is the\nSSL end point.\n\nOn Mongrel and Passenger setups, the SSL endpoint needs to forward\nthe client certificate to Puppet.\n\nOn nginx in proxy mode this can be done with:\nproxy_set_header    X-Client-Certificate     $ssl_client_cert;\n\nOn apache/passenger setups this can be done with:\nSetEnv HTTP_X_CLIENT_CERTIFICATE %{SSL_CLIENT_CERTIFICATE}e\nor\nSSLOptions +StdEnv +ExportCertData\n(but the puppet option ssl_client_certificate_header should be changed)\n\nSigned-off-by: Brice Figureau <brice-puppet@daysofwonder.com>","url":"https://api.github.com/repos/masterzen/puppet/commits/7b559b3938bf0f7eb8307519dc74af358dc3caab"},{"author":{"name":"Brice Figureau","email":"c9103f7e92504f8408c832361c569d2cccc6caad@daysofwonder.com"},"sha":"6b457def0406f80477aff589d8c8c193ce1a5c48","message":"(#10111) - Implement an ocsp verification cache\n\nSince OCSP verification requires connecting to another server\nit can be time consuming. This commit adds a cache around\nOCSP verification. Cache entries are expired after ocsp_ttl seconds\n(which defaults to 60 minutes).\n\nSigned-off-by: Brice Figureau <brice-puppet@daysofwonder.com>","url":"https://api.github.com/repos/masterzen/puppet/commits/6b457def0406f80477aff589d8c8c193ce1a5c48"}],"ref":"refs/heads/tickets/2.7.x/10111","head":"6b457def0406f80477aff589d8c8c193ce1a5c48","push_id":51415098,"size":4}