OCSP stapling support is missing for lighttpd

[meyergru]

• I have read the contributing guide lines at https://github.com/opnsense/core/blob/master/CONTRIBUTING.md
• I am convinced that my issue is new after having checked both open and closed issues at https://github.com/opnsense/core/issues?q=is%3Aissue

Is your feature request related to a problem? Please describe.

When I want to make use of ACME certificates for dual-use, like for HAproxy sites and OpnSense itself, I want to be able to use OCSP stapling. Currently, OpnSense does not support it.

Describe the solution you like

Lighttpd supports OCSP stapling since 1.4.56:

https://redmine.lighttpd.net/projects/lighttpd/wiki/Docs_SSL#OCSP-Stapling

Once could use "ssl.stapling-file" in the configuration and have a cron job that fetches its content regularly, like described in the docs.

Describe alternatives you considered

Having another non-OCSP-stapling certificate, just for OpnSense.

[Monviech]

#5567

Just for reference.

[fichtner]

IMO the whole discussion was derailed so nothing came of it. A prime example of what discouragement does to open source contributions. 🤷‍♂️

[meyergru]

Sorry, did not find it in open issues... should I close this? I would actually test it...

[Monviech]

I guess the TLDR of the whole discussion in that PR was that upstream has a script for it.