boulder
boulder copied to clipboard
ROCSP Stage 7: Clean up old OCSP code paths
After the ROCSP deployment is complete and all of the ROCSPStageX flags have been enabled in both Staging and in Prod, it will be time to clean up the various vestiges of the old way of doing things. This ticket exists to track as many of them as we can think of.
Each section of bullet points below is a set of linked changes that should be done in that order. Separate sections of bullet points can be done in any order. These lists may be updated over time as we discover more code that can be removed.
ocsp-responder
- [ ] Deprecate ROCSPStage1 flag, make the ocsp-responder/main.go code it guards unconditional
- [ ] Deprecate the ROCSPStage2 and ROCSPStage3 flags, delete the old multi_source.go, and inline redis_source.go into checked_redis_source.go
database
- [ ] Update the CA to stop generating new OCSP responses when issuing precertificates and orphaning certificates
- [ ] Update the RA to stop generating new OCSP responses when revoking certificates and updating revoked certificates
- [ ] Deprecate the ROCSPStage6 flag, and update the SA to never touch the certificateStatus.response db column
- [ ] Remove the response column from the certificateStatus table entirely (should probably be tracked as a separate bug)
ocsp-updater
- [ ] Delete cmd/ocsp-updater and all library packages it is the only consumer of