f316e6e86e
Introduces NATS.Server.Tls.OcspMode (Auto/Always/Must/Never matching Go ocsp.go constants) and OcspConfig with Mode and OverrideUrls. Adds OcspConfig? and OcspPeerVerify to NatsOptions for stapling configuration and peer certificate revocation checking. Covered by 12 new unit tests.
21 lines
714 B
C#
21 lines
714 B
C#
namespace NATS.Server.Tls;
|
|
|
|
// OcspMode mirrors the OCSPMode constants from the Go reference implementation (ocsp.go).
|
|
// Auto — staple only if the certificate contains the status_request TLS extension.
|
|
// Always — always attempt stapling; warn but continue if the OCSP response cannot be obtained.
|
|
// Must — stapling is mandatory; fail server startup if the OCSP response cannot be obtained.
|
|
// Never — never attempt stapling regardless of certificate extensions.
|
|
public enum OcspMode
|
|
{
|
|
Auto = 0,
|
|
Always = 1,
|
|
Must = 2,
|
|
Never = 3,
|
|
}
|
|
|
|
public sealed class OcspConfig
|
|
{
|
|
public OcspMode Mode { get; init; } = OcspMode.Auto;
|
|
public string[] OverrideUrls { get; init; } = [];
|
|
}
|