Skip to content

Commit

Permalink
update README
Browse files Browse the repository at this point in the history
  • Loading branch information
reaperhulk committed Feb 7, 2014
1 parent 972e562 commit 79782a5
Showing 1 changed file with 6 additions and 5 deletions.
11 changes: 6 additions & 5 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,16 +1,17 @@
#r509-validity-crl [![Build Status](https://secure.travis-ci.org/reaperhulk/r509-validity-crl.png)](http://travis-ci.org/reaperhulk/r509-validity-crl)
This project is related to [r509](http://github.com/reaperhulk/r509) and [r509-ocsp-responder](http://github.com/reaperhulk/r509-ocsp-responder) projects. It allows certificate validity and revocation information to be read from a pre-generated CRL and used to populate OCSP responses.
#r509-validity-crl [![Build Status](https://secure.travis-ci.org/r509/r509-validity-crl.png)](http://travis-ci.org/r509/r509-validity-crl) [![Coverage Status](https://coveralls.io/repos/r509/r509-validity-crl/badge.png?branch=master)](https://coveralls.io/r/r509/r509-validity-crl?branch=master)

This project is related to [r509](http://github.com/r509/r509) and [r509-ocsp-responder](http://github.com/r509/r509-ocsp-responder) projects. It allows certificate validity and revocation information to be read from a pre-generated CRL and used to populate OCSP responses.

##Usage
Remove the redis-related lines of the [config.ru](https://github.com/reaperhulk/r509-ocsp-responder#set-up-configru) for r509-ocsp-responder and replace them with this:
Remove the redis-related lines of the [config.ru](https://github.com/r509/r509-ocsp-responder#set-up-configru) for r509-ocsp-responder and replace them with this:
```ruby
require 'r509/validity/crl'
crl_paths = ['/path/to/crl','/path/to/crl2']
reload_interval = '60m'
Dependo::Registry[:validity_checker] = R509::Validity::CRL::Checker.new(crl_paths,reload_interval)
```
* Each element in crl_paths is an absolute path to a CRL to load on the filesystem. You should load those via an external cronjob.
* The reload_interval defines the interval at which the checker will reload the CRL from the filesystem. By default it is 60m.
* Each element in crl\_paths is an absolute path to a CRL to load on the filesystem. You should load those via an external cronjob.
* The reload\_interval defines the interval at which the checker will reload the CRL from the filesystem. By default it is 60m.

##Limitations
Due to the way CRLs work the responder can only operate in "known bad" mode. That is, the OCSP responder will respond *VALID* to all queries for certificates that are not explicitly revoked. This is in contrast to "known good" mode enabled by tracking all issuances with a plugin like [r509-validity-redis](http://github.com/sirsean/r509-validity-redis), which allows for *VALID*, *REVOKED*, and *UNKNOWN* responses.

0 comments on commit 79782a5

Please sign in to comment.