maskit commented on code in PR #10306:
URL: https://github.com/apache/trafficserver/pull/10306#discussion_r1320405378
##########
doc/admin-guide/files/records.yaml.en.rst:
##########
@@ -4254,6 +4254,14 @@ OCSP Stapling Configuration
Number of seconds before an OCSP response expires in the stapling cache.
+.. ts:cv:: CONFIG proxy.config.ssl.ocsp.request_mode INT 0
+
+ Set the request method to prefer when querying OCSP responders. The default
+ is zero, or POST, and a value of 1 will cause ATS to attempt a GET request.
+ Because the length of the encoded request must be less than 255 bytes per
RFC
+ 6960, Appendix A, ATS will fall back to the POST request method when the
+ encoded size exceeds this limit.
+
Review Comment:
I don't have any plans to add another mode at the moment. A possible mode
would be "Always try GET regardless of the request size". The documentation
uses "must" for the size limitation, but strictly speaking it's not a "MUST" on
the RFC.
> HTTP-based OCSP requests can use either the GET or the POST method to
submit their requests. To enable HTTP caching, small requests (that
after encoding are less than 255 bytes) MAY be submitted using GET.
If HTTP caching is not important or if the request is greater than
255 bytes, the request SHOULD be submitted using POST.
I'm not sure if there are OCSP responders that accept big GET requests, but
if some of them do, it can be an option.
@elsloo What do you think?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
