Struct OcspStaplingConfig 

pub struct OcspStaplingConfig {
    pub enabled: bool,
    pub responder_url: Option<String>,
    pub refresh_interval_secs: u64,
    pub soft_fail: bool,
}

OCSP stapling configuration for the TLS listener.

RFC 6066 Section 8: the status_request TLS extension allows the server to provide a stapled OCSP response during the TLS handshake, eliminating the client’s need to contact the OCSP responder directly.

RFC 7633 Section 4: when the server certificate contains the TLS Feature Extension (must-staple), the server MUST provide a stapled response; failure to do so causes compliant clients to abort.

Fields

enabled: bool

Enable OCSP stapling.

When true, the server fetches an OCSP response for its own certificate at startup and refreshes it periodically.

Default: false.

responder_url: Option<String>

Override the OCSP responder URL.

When None, the responder URL is extracted from the server certificate’s Authority Information Access (AIA) extension (OID 1.3.6.1.5.5.7.48.1).

Set this when the AIA URL is not reachable from the server (e.g., behind a firewall) and a local OCSP responder proxy is available.

refresh_interval_secs: u64

Interval in seconds between OCSP response refreshes.

The server fetches a fresh OCSP response from the responder at this interval, replacing the cached stapled response.

Default: 14400 (4 hours). OCSP responses typically have a nextUpdate validity of 24-48 hours, so refreshing every 4 hours provides adequate margin.

soft_fail: bool

Allow serving TLS without a stapled OCSP response when the OCSP responder is unreachable.

When true (soft-fail mode), the server continues to accept TLS connections without a stapled response if the OCSP responder cannot be reached. A stale cached response is served if still within its nextUpdate window. A warning is logged on each failed refresh attempt.

When false (hard-fail mode), the server refuses to start if the initial OCSP fetch fails, and transitions to unhealthy status if subsequent refreshes fail with no valid cached response.

Default: true.

Trait Implementations

impl Clone for OcspStaplingConfig

fn clone(&self) -> OcspStaplingConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for OcspStaplingConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for OcspStaplingConfig

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for OcspStaplingConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.