nginx: Add ssl_stapling validation
authorGrant Slater <git@firefishy.com>
Thu, 22 Aug 2019 19:31:18 +0000 (20:31 +0100)
committerGrant Slater <git@firefishy.com>
Thu, 22 Aug 2019 19:31:18 +0000 (20:31 +0100)
cookbooks/nginx/templates/default/nginx.conf.erb

index 4b2c15f..ae0d8bd 100644 (file)
@@ -40,6 +40,11 @@ http {
     ssl_session_cache shared:SSL:50m;
     ssl_session_timeout 30m;
     ssl_stapling on;
+
+    # Validate the stapling response is signed by a trusted certificate
+    ssl_stapling_verify on;
+    ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt;
+
     ssl_dhparam /etc/ssl/certs/dhparam.pem;
     resolver <%= @resolvers.join(" ") %>;
     resolver_timeout 5s;