Re: "ssl_stapling" without configured "resolver" caches responder IP indefinitely

2022-01-28 Thread hablutzel1
Hi Maxim, I'm not really familiar with NGINX source code or with the C language for that matter, so could you please provide more detail on why does NGING require a non-blocking DNS resolver? Couldn't it rely on child processes or threads to not block? Posted at Nginx Forum: https://forum.nginx.o

"ssl_stapling" without configured "resolver" caches responder IP indefinitely

2022-01-28 Thread hablutzel1
Hi, while testing the latest NGINX source code around ~1.21.7, I’ve observed that enabling "ssl_stapling" without configuring a “resolver”, makes NGINX cache the OCSP responder IP indefinitely, so, if the CA later changes the OCSP responder IP, NGINX is still going to try to get OCSP queries from t