OSCP stapling on Supervisor Contour service / TKG Contour packages

Products

• VMware vSphere Kubernetes Service

Issue/Introduction

Users may request steps to enable OCSP stapling directly within the Contour/Envoy layer for compliance or security requirements.

 

What is OCSP stapling?

OCSP (Online Certificate Status Protocol) stapling optimizes the SSL/TLS handshake by shifting the certificate revocation check from the client browser to the web server.

• How it works: The server periodically fetches a digitally signed validity proof from the Certificate Authority (CA) and "staples" it directly to the certificate during the TLS handshake.
• Performance: Eliminates extra DNS lookups, reducing connection latency and improving page load speeds.
• Privacy: Prevents the CA from tracking user browsing habits and destination IPs.
• Reliability: Ensures uninterrupted access even if the CA verification servers experience downtime.

Environment

VMware vSphere Kubernetes Service

VMware Supervisor 

Resolution

Contour does not natively support OCSP stapling. This is a deliberate design choice, and there are currently no plans to implement this feature ( Support OCSP Stapling · Issue #4683 · projectcontour/contour)

Recommended Architecture:

Because traffic in most Tanzu/Contour environments is routed through a load balancer (such as VMware AVI/NSX ALB or F5), the most robust way to implement OCSP stapling is at the ingress load balancer layer.

1. Do not attempt configuration in Contour/Envoy: There are no configuration parameters in the Contour ConfigMap or HTTPProxy CRDs to enable this.
2. Configure at the Load Balancer: Implement OCSP stapling on your front-end Load Balancer (e.g., AVI/F5). The Load Balancer is responsible for TLS termination and can be configured to cache and staple OCSP responses.
3. Maintain Trust: Ensure the Load Balancer trusts the certificate presented by the Envoy pods, and the Envoy pods trust the certificates from the backend applications. No special configuration is required on the Contour side.

Reference for AVI LB:

 https://techdocs.broadcom.com/us/en/vmware-security-load-balancing/avi-load-balancer/avi-load-balancer/32-1/vmware-avi-load-balancer-configuration-guide/security/ocsp-stapling-in-nsx-advanced-load-balancer.html

Reference for F5 Load balancer:

https://docs.cloud.f5.com/docs-v2/multi-cloud-app-connect/how-to/adv-security/configure-ocsp