@@ -200,6 +200,102 @@ wolfssl ca -altextend -in B.cert -keyfile ecc-key-A.priv -altkey ml-dsa-key-A.pr
200200wolfssl ca -altextend -in C.cert -keyfile ecc-key-B.priv -altkey ml-dsa-key-B.priv -altpub ml-dsa-key-C.pub -subjkey ecc-key-C.priv -cert B-chimera.cert -out C-chimera.cert
201201```
202202
203+ ## Deploying an OCSP Responder with nginx and SCGI
204+
205+ wolfCLU includes an OCSP responder that can be deployed in production using nginx as an HTTP frontend and SCGI (Simple Common Gateway Interface) as the communication protocol. ** This is the preferred deployment method** because SCGI is much simpler than HTTP while allowing you to leverage a mature and robust HTTP implementation like nginx.
206+
207+ ### Why SCGI?
208+
209+ - ** Simplicity** : SCGI is a straightforward protocol that's easier to implement than full HTTP
210+ - ** Robustness** : nginx handles all HTTP concerns (timeouts, keep-alive, TLS, load balancing, etc.)
211+ - ** Separation of roles** : The OCSP responder focuses on OCSP logic, nginx handles web serving
212+
213+ ### Prerequisites
214+
215+ Install nginx:
216+ ```
217+ sudo apt-get install nginx # Debian/Ubuntu
218+ sudo yum install nginx # RHEL/CentOS
219+ brew install nginx # macOS
220+ ```
221+
222+ ### Basic Setup
223+
224+ 1 . ** Start the wolfCLU OCSP responder in SCGI mode:**
225+
226+ ``` bash
227+ wolfssl ocsp -scgi \
228+ -port 8081 \
229+ -index /path/to/index.txt \
230+ -rsigner /path/to/ca-cert.pem \
231+ -rkey /path/to/ca-key.pem \
232+ -CA /path/to/ca-cert.pem
233+ ```
234+
235+ The responder will listen on port 8081 for SCGI connections.
236+
237+ 2 . ** Configure nginx to proxy HTTP OCSP requests to the SCGI backend:**
238+
239+ Create a file ` /etc/nginx/ocsp-scgi.conf ` :
240+
241+ ``` nginx
242+ # SCGI parameters for OCSP
243+ scgi_param REQUEST_METHOD $request_method;
244+ scgi_param REQUEST_URI $request_uri;
245+ scgi_param QUERY_STRING $query_string;
246+ scgi_param CONTENT_TYPE $content_type;
247+ scgi_param CONTENT_LENGTH $content_length;
248+
249+ scgi_param SCRIPT_NAME $fastcgi_script_name;
250+ scgi_param DOCUMENT_URI $document_uri;
251+ scgi_param DOCUMENT_ROOT $document_root;
252+ scgi_param SERVER_PROTOCOL $server_protocol;
253+ scgi_param HTTPS $https if_not_empty;
254+
255+ scgi_param REMOTE_ADDR $remote_addr;
256+ scgi_param REMOTE_PORT $remote_port;
257+ scgi_param SERVER_PORT $server_port;
258+ scgi_param SERVER_NAME $server_name;
259+ ```
260+
261+ Add to your nginx site configuration (e.g., ` /etc/nginx/sites-available/default ` ):
262+
263+ ``` nginx
264+ server {
265+ listen 80;
266+ server_name ocsp.example.com;
267+
268+ location /ocsp {
269+ scgi_pass localhost:8081;
270+ include /etc/nginx/ocsp-scgi.conf;
271+
272+ scgi_connect_timeout 5s;
273+ scgi_send_timeout 10s;
274+ scgi_read_timeout 10s;
275+ }
276+ }
277+ ```
278+
279+ 3 . ** Reload nginx:**
280+
281+ ``` bash
282+ sudo nginx -t # Test configuration
283+ sudo systemctl reload nginx # Reload nginx
284+ ```
285+
286+ 4 . ** Test the OCSP responder:**
287+
288+ ``` bash
289+ wolfssl ocsp \
290+ -issuer ca-cert.pem \
291+ -cert server-cert.pem \
292+ -url http://ocsp.example.com/ocsp
293+ ```
294+
295+ ### Index File Format
296+
297+ The ` -index ` file uses OpenSSL's CA index format.
298+
203299## Contacts
204300
205301Please contact support@wolfssl.com with any questions or comments.
0 commit comments