tls.Provision does not respect disable_ocsp_stapling

[cds2-stripe]

Hello!

We were very excited to see 09432ba as we're running Caddy in an environment without internet access, and the 10s timeout per cert for OCSP stapling means we have to wait a while for Caddy to start.

I went to test v2.4.0-beta.1 and added the following to our Caddy JSON configuration file. From reading the source it appears that not specifying a subject matches all hostnames.

+      "automation": {
+        "policies": [
+          {
+            "disable_ocsp_stapling": true
+          }
+        ]
+      },

After rolling out the change above we still saw OCSP timeouts during startup. Reading through the code, it looks like tls.Provision is making calls to magic.CacheUnmanagedTLSCertificate using a CertMagic configuration that does not respect DisableOCSPStapling https://github.com/caddyserver/caddy/blob/v2.4.0-beta.1/modules/caddytls/tls.go#L187.

I'm not sure what the best approach is for threading this through, especially during tls.Provision. It would be great if we could just disable this globally!

[mholt]

This is intentional, according to the original issue. OCSP stapling can only be disabled for managed (automated) certificates. For certificates you have manual control over, don't issue them with the OCSP responder field.

[mholt]

@cds2-stripe I went ahead and made this configurable in 2250920 -- allowing you to disable OCSP stapling for manual certificates. (Note that it does not apply to automated certificates, which use automation policies instead.)

[cds2-stripe]

Thank you! Our CA doesn't allow us to issue certificates with the OCSP responder field unset.