-
Notifications
You must be signed in to change notification settings - Fork 134
Deploying OCSP on Podman
Note
|
This page is still under construction. |
This document describes the process to deploy OCSP container on Podman with PKI 11.6 or later.
Current limitations:
-
Replication is not yet supported (i.e. no scaling)
-
HSM is not yet supported
-
No security domain (i.e. other subsystems need to be set up manually)
-
Long startup time (due to certs import and instance creation)
Create a network for the containers, for example:
$ podman network create example
Alternatively, use an existing network.
To deploy the OCSP container, prepare the following files:
-
server.p12
which contains:-
ca_signing
certificate (see Generating CA Signing Certificate) -
ocsp_signing
certificate and key (see Generating OCSP Signing Certificate) -
sslserver
certificate and key (see Generating SSL Server Certificate)
-
-
ocsp_signing.csr
certificate request -
sslserver.csr
certificate request
Then store the files in a location that will be mapped to the /certs
folder in the OCSP container.
See also:
Run the OCSP container with the following command:
$ podman run \ --name ocsp \ --hostname ocsp.example.com \ --network example \ --network-alias ocsp.example.com \ -v $PWD/certs:/certs \ -v $PWD/conf:/conf \ -v $PWD/logs:/logs \ -e PKI_DS_URL=ldap://ds.example.com:3389 \ -e PKI_DS_PASSWORD=Secret.123 \ -d \ quay.io/dogtagpki/pki-ocsp:latest
Wait until the OCSP service is running:
$ podman logs -f ocsp
If the OCSP container is no longer needed, it can be removed with the following command:
$ podman rm -f ocsp
Tip
|
To find a page in the Wiki, enter the keywords in search field, press Enter, then click Wikis. |