[{"_1":2,"_223":-5,"_224":-5},"loaderData",{"_3":4,"_13":14,"_19":20,"_191":192},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","routes/_layout",{"_15":-5,"_16":17,"_18":17},"username","isAskGordonEnabled",true,"isUsingNewTemplate","routes/_layout.r.$namespace.$reponame",{"_21":22,"_23":-5,"_24":11,"_25":11,"_26":27,"_28":29,"_30":-5,"_31":11,"_32":33,"_92":-5,"_93":94,"_184":-5,"_185":11,"_186":11,"_187":11,"_188":-5,"_189":190},"canonicalUrl","https://hub.docker.com/r/wackysysadmin/ocsp-responder/tags","mcpServer","canSeeDockerfile","canSeeAutobuilds","namespace","wackysysadmin","reponame","ocsp-responder","cloudBuildSource","isAutobuildsAvailable","repo",{"_34":35,"_47":48,"_50":51,"_52":53,"_54":11,"_55":56,"_57":58,"_59":60,"_37":29,"_26":27,"_62":63,"_64":49,"_65":66,"_67":68,"_69":70,"_71":-5,"_72":66,"_73":74,"_75":11,"_76":27,"_77":78,"_83":11,"_84":85,"_89":27,"_90":91},"categories",[36,41,44],{"_37":38,"_39":40},"name","Security","slug","security",{"_37":42,"_39":43},"Developer tools","developer-tools",{"_37":45,"_39":46},"Web servers","web-servers","content_types",[49],"image","date_registered","2024-06-07T20:24:28.984126Z","description","Containerised OpenSSL OCSP responder.\nhttps://github.com/wackysysadmin/ocsp-responder-container","is_private","last_updated","2026-08-23T00:58:48.183983Z","last_modified","2024-12-22T09:49:09.010916Z","media_types",[61],"application/vnd.oci.image.index.v1+json","pull_count",5795,"repository_type","star_count",0,"status",1,"status_description","active","source","collaborator_count","full_description","# Containerised OCSP Responder\nThis is a containerised version of the OCSP web responder built into OpenSSL.\n\nHad built this to add onto my certificates primarily to remove the warning on Microsoft's Terminal Services Client about being unable to validate the certificate against a responder when RDP'ing onto a server.\n\nImage tag latest rebuilt every week with latest Alpine image and updated packages.\n\nRepository: https://github.com/wackysysadmin/ocsp-responder-container\n\n

Prerequisites

\nThis container relies on already having the following:\n\n* A working CA and/or intermediate server (Useful Guide: https://jamielinux.com/docs/openssl-certificate-authority/index.html, https://bounca.org, https://lab-ca.net etc)\n* An index file containing a list of current valid/revoked/expired certificates. (Otherwise known as the 'database' file in OpenSSL terminology)\n* The public certificate of your CA, or chain of the CA and intermediate.\n* An OCSP signing keypair from your CA or intermediate. (Guide: https://bhashineen.medium.com/create-your-own-ocsp-server-ffb212df8e63)\n\n

Running the container

Environment Variables

\n\nThe following variables are file locations relative to the container.\n\n* OCSP_INT_PORT: \"2560\" # OCSP mounting port internal to the container.\n* INDEX_FILE: \"/data/index.txt\" # The database file of the CA.\n* CA_FILE: \"/data/ca-chain.cert.pem\" # The CA or CA and intermediate public chain certificate.\n* OCSP_CERT_FILE: \"/data/ocsp.pem\" # OCSP public certificate signed by the CA or intermediate.\n* OCSP_KEY_FILE: \"/data/ocsp.key\" # OCSP private key.\n* OCSP_LOG_FILE: \"/data/ocsp.log\" # OCSP process's output log file, HTTP access logs and responses. The container will generate this logfile.\n\n

Using Docker Compose

\nCreate a docker-compose.yml file with the contents of https://github.com/wackysysadmin/ocsp-responder-container/blob/main/docker-compose.yml.\n\n\nModify the volume path to the path of your files.\n\nBring up the OCSP responder server:\n```\ndocker compose up -d\n```\n\n```\ndocker logs ocsp-responder\nACCEPT 0.0.0.0:2560 PID=1\nocsp: waiting for OCSP client connections...\n```\n\nCertificates can now be signed by defining your OCSP's FQDN. Example configuration: authorityInfoAccess = OCSP;URI:http://ocsp.hostname.foo:2560\n\n

Reverse Proxy/HTTPS Support

\nThe OCSP responder server can be put behind a reverse proxy such as Caddy/NGINX/Traefik.\n\nThis can be done by using a method of your choice, if you append a reverse proxy onto the Docker Compose file or if the reverse proxy server is on the same container bridge network you can specify http://ocsp-responder:2560 as the proxy upstream address.\n\nServing an OCSP responder over HTTPS (https://datatracker.ietf.org/doc/html/rfc5280#section-8) isn't a requirement but is certainly possible, as mentioned in the wider community OCSP requirements on CA/Intermediate certificates can cause issues, using them on issued server/client certificates from them should be fine. \n\n

Building the container from scratch

\nThe container can be built manually, it is only an Alpine image with OpenSSL and CMD values set.\n\nEnter a directory and create a Dockerfile with the contents from https://github.com/wackysysadmin/ocsp-responder-container/blob/main/Dockerfile.\n\nCreate the container using build command:\n```\ndocker build -t ocsp-responder:latest .\n```\n

Known issues

\n\n* All files can be direct mounted into the container, however the index/database file must be in a mounted folder.\nThis is due to Docker mounting the file as it is at the time. If there are changes to the index it will not be reflected unless the container gets restarted. For my use case I created an ocsp folder then changed my openssl.cnf to save changes to an index.txt in the ocsp folder.\n","has_starred","hub_user","immutable_tags_settings",{"_79":11,"_80":81},"enabled","rules",[82],".*","is_automated","permissions",{"_86":17,"_87":11,"_88":11},"read","write","admin","user","storage_size",2022215676,"orgData","recentTags",[95],{"_96":49,"_97":98,"_99":100,"_101":102,"_103":104,"_105":106,"_55":172,"_173":98,"_174":27,"_175":61,"_37":176,"_177":178,"_179":180,"_181":172,"_182":70,"_183":17},"content_type","creator",27370455,"digest","sha256:70b6c9e3f03fc1b52fccfd07432286049996cff9c09769987e63d321779a8ac0","full_size",7327450,"id",691629942,"images",[107,123,129,135,142,148,154,160,166],{"_108":109,"_99":110,"_111":112,"_113":114,"_115":116,"_117":118,"_119":112,"_120":-5,"_121":102,"_67":70,"_122":-5},"architecture","386","sha256:8514cefce36028effb79c9bc54ca75200baec725466a081e39030fc7c5848249","features","","last_pulled","2026-08-24T10:11:33.074159904Z","last_pushed","2026-08-23T00:58:40.312683523Z","os","linux","os_features","os_version","size","variant",{"_108":124,"_99":125,"_111":112,"_113":126,"_115":127,"_117":118,"_119":112,"_120":-5,"_121":128,"_67":70,"_122":-5},"amd64","sha256:914581b3f6b1511d4389f52fa96a19c5a66343652fae5a7634e41e3f1aee1a32","2026-08-24T18:19:51.462996822Z","2026-08-23T00:58:39.464659283Z",7701885,{"_108":130,"_99":131,"_111":112,"_113":132,"_115":133,"_117":118,"_119":112,"_120":-5,"_121":134,"_67":70,"_122":-5},"arm64","sha256:3cb0ec72c01d248f820f373ec8bcf59ef26b37d174d83e0c2107312444a197d6","2026-08-24T10:11:33.03423328Z","2026-08-23T00:58:38.537238749Z",8024812,{"_108":136,"_99":137,"_111":112,"_113":138,"_115":139,"_117":118,"_119":112,"_120":-5,"_121":140,"_67":70,"_122":141},"arm","sha256:fb98932eca36a98fd3a1684ae8beb23c01c26c33ce701fac4d22e9cd74434982","2026-08-24T10:11:33.077856909Z","2026-08-23T00:58:41.339350905Z",7035799,"v6",{"_108":136,"_99":143,"_111":112,"_113":144,"_115":145,"_117":118,"_119":112,"_120":-5,"_121":146,"_67":70,"_122":147},"sha256:e9b4f3042bc1acd3482fdea5f706f59d522d14356a095d1c67d6800ddcc2ae10","2026-08-24T10:11:33.156179963Z","2026-08-23T00:58:43.984691697Z",6891521,"v7",{"_108":136,"_99":149,"_111":112,"_113":150,"_115":151,"_117":118,"_119":112,"_120":-5,"_121":152,"_67":70,"_122":153},"sha256:927dd971b512f5cbf694446bab02c2bbd22235a1beb38a470b8cbb0ba68f59f4","2026-08-24T10:11:33.247577891Z","2026-08-23T00:58:43.510487207Z",6891530,"v8",{"_108":155,"_99":156,"_111":112,"_113":157,"_115":158,"_117":118,"_119":112,"_120":-5,"_121":159,"_67":70,"_122":-5},"ppc64le","sha256:fca080c4dca249f4e1810ab854b0add58791d05244bf24f5792f73886b27dd93","2026-08-24T10:11:33.251996671Z","2026-08-23T00:58:42.994207333Z",7598447,{"_108":161,"_99":162,"_111":112,"_113":163,"_115":164,"_117":118,"_119":112,"_120":-5,"_121":165,"_67":70,"_122":-5},"riscv64","sha256:c416166ec6599e379b92dff473185d261152149210cf64168bb4b183f64d5768","2026-08-24T10:11:33.261049148Z","2026-08-23T00:58:42.128382872Z",6948302,{"_108":167,"_99":168,"_111":112,"_113":169,"_115":170,"_117":118,"_119":112,"_120":-5,"_121":171,"_67":70,"_122":-5},"s390x","sha256:2d680658f709c4f8d6ba54a2207d4f6bdba83876c459ada620cb95a144f88f5d","2026-08-24T10:11:33.308966137Z","2026-08-23T00:58:40.858264251Z",7355020,"2026-08-23T00:58:46.659752Z","last_updater","last_updater_username","media_type","latest","repository",24314030,"tag_last_pulled","2026-08-24T21:24:01.347659933Z","tag_last_pushed","tag_status","v2","sbxKitMetadata","isPotentialSpam","isHubSbxKitsEnabled","displaySecurityMetadata","tagAttestations","tagsHaveAttestations",[],"routes/_layout.r.$namespace.$reponame.tags",{"_32":193,"_203":204,"_189":221,"_222":11},{"_34":194,"_47":198,"_50":51,"_52":53,"_54":11,"_55":56,"_57":58,"_59":199,"_37":29,"_26":27,"_62":63,"_64":49,"_65":66,"_67":68,"_69":70,"_71":-5,"_72":66,"_73":74,"_75":11,"_76":27,"_77":200,"_83":11,"_84":202,"_89":27,"_90":91},[195,196,197],{"_37":38,"_39":40},{"_37":42,"_39":43},{"_37":45,"_39":46},[49],[61],{"_79":11,"_80":201},[82],{"_86":17,"_87":11,"_88":11},"tags",{"_205":68,"_206":-5,"_207":-5,"_208":209},"count","next","previous","results",[210],{"_96":49,"_97":98,"_99":100,"_101":102,"_103":104,"_105":211,"_55":172,"_173":98,"_174":27,"_175":61,"_37":176,"_177":178,"_179":180,"_181":172,"_182":70,"_183":17},[212,213,214,215,216,217,218,219,220],{"_108":109,"_99":110,"_111":112,"_113":114,"_115":116,"_117":118,"_119":112,"_120":-5,"_121":102,"_67":70,"_122":-5},{"_108":124,"_99":125,"_111":112,"_113":126,"_115":127,"_117":118,"_119":112,"_120":-5,"_121":128,"_67":70,"_122":-5},{"_108":130,"_99":131,"_111":112,"_113":132,"_115":133,"_117":118,"_119":112,"_120":-5,"_121":134,"_67":70,"_122":-5},{"_108":136,"_99":137,"_111":112,"_113":138,"_115":139,"_117":118,"_119":112,"_120":-5,"_121":140,"_67":70,"_122":141},{"_108":136,"_99":143,"_111":112,"_113":144,"_115":145,"_117":118,"_119":112,"_120":-5,"_121":146,"_67":70,"_122":147},{"_108":136,"_99":149,"_111":112,"_113":150,"_115":151,"_117":118,"_119":112,"_120":-5,"_121":152,"_67":70,"_122":153},{"_108":155,"_99":156,"_111":112,"_113":157,"_115":158,"_117":118,"_119":112,"_120":-5,"_121":159,"_67":70,"_122":-5},{"_108":161,"_99":162,"_111":112,"_113":163,"_115":164,"_117":118,"_119":112,"_120":-5,"_121":165,"_67":70,"_122":-5},{"_108":167,"_99":168,"_111":112,"_113":169,"_115":170,"_117":118,"_119":112,"_120":-5,"_121":171,"_67":70,"_122":-5},[],"canDeleteTags","actionData","errors"]

Digest	OS/ARCH	Compressed size
8514cefce360	linux/386	6.99 MB
914581b3f6b1	linux/amd64	7.35 MB
fb98932eca36	linux/arm/v6	6.71 MB

Help

System theme

Docker Suite

wackysysadmin/ocsp-responder

Tags for wackysysadmin/ocsp-responder