Struct OcspStapler 

pub struct OcspStapler { /* private fields */ }

Background task that periodically refreshes the stapled OCSP response.

RFC 6066 Section 8 / RFC 7633:

The stapler fetches an OCSP response for the server’s end-entity certificate from the configured (or AIA-derived) OCSP responder URL. It replaces the cached response atomically so in-flight handshakes are not affected.

Refresh strategy

1. Fetch at startup (blocking — the server does not accept TLS connections until the first response is obtained, unless soft_fail is true).
2. Re-fetch at refresh_interval_secs intervals.
3. On fetch failure: log a warning and keep serving the stale response if soft_fail is enabled and the response has not passed its nextUpdate window.

Implementations

impl OcspStapler

pub fn new( config: OcspStaplingConfig, server_cert_der: Vec<u8>, issuer_cert_der: Option<Vec<u8>>, ) -> Self

Create a new OCSP stapler.

Arguments

• config — OCSP stapling configuration from [tls.ocsp_stapling].
• server_cert_der — DER bytes of the server’s end-entity certificate.
• issuer_cert_der — DER bytes of the issuing CA certificate (second cert in the chain file). Needed to construct the OCSP request.

pub fn response_handle(&self) -> OcspResponseHandle

Returns a clone of the shared OCSP response handle.

Pass this to the TLS accept loop so it can read the current stapled response during handshakes.

pub async fn run(&self)

Run the OCSP refresh loop.

This should be spawned as a background tokio task. It runs indefinitely, fetching a fresh OCSP response at the configured interval.

Cancellation

The task is cancel-safe. Dropping the JoinHandle stops the loop.