Copying from my defunct repo.
Rough idea: Fire "alerts" to configured binaries/scripts to e.g. post to Slack when a cert is added, or the cached ocsp response is updated, or expires.
Should be some kind of simple arg to a shell script interface. I'm thinking of libvirt hooks for inspiration.
One specific use-case I have is to support HAProxy integration by having a hook that fires when the OCSP response is refreshed. This hook can connect to the HAProxy stats socket and instruct the TLS terminator to reload the new OCSP response from disk.
You can see one approach to live reloading an OCSP response in HAProxy here: https://github.com/pierky/haproxy-ocsp-stapling-updater/blob/master/hapos-upd#L482:L517 Other TLS terminators will likely have their own versions of this feature in the future.
Copying from my defunct repo.
Rough idea: Fire "alerts" to configured binaries/scripts to e.g. post to Slack when a cert is added, or the cached ocsp response is updated, or expires.
Should be some kind of simple arg to a shell script interface. I'm thinking of
libvirthooks for inspiration.One specific use-case I have is to support HAProxy integration by having a hook that fires when the OCSP response is refreshed. This hook can connect to the HAProxy stats socket and instruct the TLS terminator to reload the new OCSP response from disk.
You can see one approach to live reloading an OCSP response in HAProxy here: https://github.com/pierky/haproxy-ocsp-stapling-updater/blob/master/hapos-upd#L482:L517 Other TLS terminators will likely have their own versions of this feature in the future.