Fix for jfrog#355

TeamSalvador · Jan 5, 2024 · 2d3e78c · 2d3e78c
1 parent 0419e12
commit 2d3e78c
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 1 deletion.
diff --git a/Ansible/ansible_collections/jfrog/platform/roles/artifactory_nginx_ssl/defaults/main.yml b/Ansible/ansible_collections/jfrog/platform/roles/artifactory_nginx_ssl/defaults/main.yml
@@ -18,3 +18,5 @@ ssl_certificate_path: /etc/pki/tls/certs
 ssl_certificate_key_path: /etc/pki/tls/private
 ssl_certificate: cert.pem
 ssl_certificate_key: cert.key
+# if ssl_certificate has the full certificate chain then OCSP stapling can be enabled
+ssl_certificate_fullchain: false
diff --git a/...ible_collections/jfrog/platform/roles/artifactory_nginx_ssl/templates/artifactory.conf.j2 b/...ible_collections/jfrog/platform/roles/artifactory_nginx_ssl/templates/artifactory.conf.j2
@@ -13,8 +13,13 @@
   ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
   ssl_certificate      {{ ssl_certificate_path }}/{{ ssl_certificate }};
   ssl_certificate_key  {{ ssl_certificate_key_path }}/{{ ssl_certificate_key }};
+  {% if ssl_certificate_fullchain %}
+  ssl_stapling on;
+  ssl_stapling_verify on;
+  {% endif %}
   ssl_session_cache shared:SSL:1m;
   ssl_prefer_server_ciphers   on;
+
   ## server configuration
   server {
   listen 443 ssl http2;
@@ -47,4 +52,4 @@
     proxy_pass    http://artifactory-direct;
     }
   }
-}
+}