Deploying OCSP on Podman

Overview

Note	This page is still under construction.

This document describes the process to deploy OCSP container on Podman with PKI 11.6 or later.

Current limitations:

• Replication is not yet supported (i.e. no scaling)

• HSM is not yet supported

• No security domain (i.e. other subsystems need to be set up manually)

• Long startup time (due to certs import and instance creation)

Creating Network

Create a network for the containers, for example:

$ podman network create example

Alternatively, use an existing network.

Generating System Certificates

To deploy the OCSP container, prepare the following files:

• server.p12 which contains:

  • ca_signing certificate (see Generating CA Signing Certificate)

  • ocsp_signing certificate and key (see Generating OCSP Signing Certificate)

  • audit_signing certificate and key (see Generating Audit Signing Certificate)

  • subsystem certificate and key (see Generating Subsystem Certificate)

  • sslserver certificate and key (see Generating SSL Server Certificate)

• admin.p12 which contains:

  • ca_signing certificate (see Generating CA Signing Certificate)

  • admin certificate and key (see Generating Admin Certificate)

• ocsp_signing.csr certificate request

• audit_signing.csr certificate request

• subsystem.csr certificate request

• sslserver.csr certificate request

• admin.csr certificate request

Then store the files in a location that will be mapped to the /certs folder in the OCSP container.

See also:

• Generating System Certificates

• PKI PKCS12 CLI

Preparing KRA Database

• Setting up OCSP Database

• Setting up OCSP Database User (optional)

• Setting up OCSP Admin User

Deploying OCSP Container

Run the OCSP container with the following command:

$ podman run \
    --name ocsp \
    --hostname ocsp.example.com \
    --network example \
    --network-alias ocsp.example.com \
    -v $PWD/certs:/certs \
    -v $PWD/conf:/conf \
    -v $PWD/logs:/logs \
    -e PKI_DS_URL=ldap://ds.example.com:3389 \
    -e PKI_DS_PASSWORD=Secret.123 \
    -d \
    quay.io/dogtagpki/pki-ocsp:latest

Wait until the OCSP service is running:

$ podman logs -f ocsp

Removing OCSP Container

If the OCSP container is no longer needed, it can be removed with the following command:

$ podman rm -f ocsp