google / sxg-rs

A set of tools for generating signed exchanges at serve time.
Apache License 2.0
83 stars 20 forks source link

Switch Fastly ACME state to use Object Store #382

Open twifkak opened 1 year ago

twifkak commented 1 year ago

Object Store is a read/write KV-store we could use to store ACME state (including newly acquired certs) and cached OCSP responses. It's currently in private beta.

Currently we're using Dictionaries which are read-only from the compute layer -- this requires the use of the apply-acme-cert binary to modify ACME state from a VM outside the compute layer every ~90 days. And we are not caching OCSP responses, relying on the OCSP responder's caching layer (in contravention of this recommendation).