Running as container

OCSPd is also packaged as a container, and can be run on container runtimes such as Docker or Kubernetes CRI-compliant runtimes.

Database considerations

OCSPd uses an embedded database to store application configuration. The database is created automatically when OCSPd is started for the first time. The database is stored in the /ocspd/database directory and needs to be persisted :

  • On Docker, this can be done through a Docker volume or a bind mount.

  • On Kubernetes, this can be done through a persistent volume claim.

Docker example

The bare minimum requirements to start an OCSPd instance is to pass through environment variables at least :

  • a valid license through the LICENSE variable

  • an application secret through the APPLICATION_SECRET variable

To do so, just run the following command :

docker run -p 9000:9000 -e LICENSE=$(cat ./ocspd.lic) -e APPLICATION_SECRET=QA3BgXqapXaEzLbX -v ./database:/ocspd/database:rw registry.evertrust.io/ocspd:3.1.3

The OCSPd server will be available at http://localhost:9000. To configure the instance, please refer to the configuration section.

Configuration

The Docker image is configured through environment variables. The following environment variables are available :

General configuration

Variable Type Description Default

LICENSE

string

A valid OCSPd license string, base64-encoded. Can be used if LICENSE_PATH is empty.

LICENSE_PATH

path

Path where an OCSPd license file is mounted inside the container. Can be used if the license is not passed directly through LICENSE.

APPLICATION_SECRET

string

Application secret used by OCSPd

Your license usually contains newline characters, that you must replace by '\n' when setting it through the environment.

Configuring HTTPS

In production, it is strongly recommended to ensure all requests go through a layer of encryption. Configuring TLS for OCSPd will allow your reverse proxy to request OCSPd data using TLS.

If all settings are left empty, OCSPd will generate a self-signed certificate upon startup and still expose its HTTPS endpoint on
Variable Type Description Default

HTTP_PORT

port

Port of the HTTP server

9000

HTTPS_PORT

port

Port of the HTTPS server

9443

HTTPS_KEYSTORE_PATH

string

Location where the keystore containing a server certificate is located.

HTTPS_KEYSTORE_PASSWORD

string

Password for the given keystore, if required by the keystore type

HTTPS_KEYSTORE_TYPE

string

Format in which the keystore is. Can be either pkcs12, jks or pem (a base64-encoded DER certificate)

pkcs12

HTTPS_KEYSTORE_ALGORITHM

string

The key store algorithm

Platform default algorithm

Mailer configuration

Variable Type Description Default

SMTP_HOST

string

SMTP host

SMTP_PORT

port

SMTP port

SMTP_SSL

boolean

Whether SSL should be used

SMTP_TLS

boolean

Whether TLS should be used

SMTP_USER

string

SMTP user

SMTP_PASSWORD

string

SMTP password

Radius configuration

Variable Type Description Default

RADIUS_HOST

string

Radius host

RADIUS_SECRET

string

Radius secret

RADIUS_PORT

port

Radius port

RADIUS_PROTOCOL

string

Radius protocol, PAP or CHAP

PAP

LDAP configuration

Variable Type Description Default

LDAP_HOST

string

LDAP host

RADIUS_SECRET

string

Radius secret

LDAP_PORT

port

LDAP port

LDAP_SSL

boolean

Whether SSL should be used for LDAP

LDAP_BIND_DN

string

Bind DN used to authenticate to LDAP

LDAP_BIND_PASSWORD

string

Bind password used to authenticate to LDAP

LDAP_BASE_DN

string

LDAP base DN

LDAP_USERNAME_ATTRIBUTE

string

LDAP username attribute