Add OCSP softfail option

[freeradius.git] / raddb / mods-available / eap

diff --git a/raddb/mods-available/eap b/raddb/mods-available/eap
index 71aa702..26a7f43 100644 (file)
--- a/raddb/mods-available/eap
+++ b/raddb/mods-available/eap
@@ -443,6 +443,44 @@
                              #  Responder is running as a vhost.
                              #
                              url = "http://127.0.0.1/ocsp/"
+
+                             #
+                             # If the OCSP Responder can not cope with nonce
+                             # in the request, then it can be disabled here.
+                             #
+                             # For security reasons, disabling this option
+                             # is not recommended as nonce protects against
+                             # replay attacks.
+                             #
+                             # Note that Microsoft AD Certificate Services OCSP
+                             # Responder does not enable nonce by default. It is
+                             # more secure to enable nonce on the responder than
+                             # to disable it in the query here.
+                             # See http://technet.microsoft.com/en-us/library/cc770413%28WS.10%29.aspx
+                             #
+                             # use_nonce = yes
+
+                             #
+                             # Number of seconds before giving up waiting
+                             # for OCSP response. 0 uses system default.
+                             #
+                             # timeout = 0
+
+                             #
+                             # Normally an error in querying the OCSP
+                             # responder (no response from server, server did
+                             # not understand the request, etc) will result in
+                             # a validation failure.
+                             #
+                             # To treat these errors as 'soft' failures and
+                             # still accept the certificate, enable this
+                             # option.
+                             # 
+                             # Warning: this may enable clients with revoked
+                             # certificates to connect if the OCSP responder
+                             # is not available. Use with caution.
+                             #
+                             # softfail = no
                        }
                }