Files

master c58a236d70 Doctor plugin checks: implement health check classes and documentation

Implement remediation-aware health checks across all Doctor plugin modules
(Agent, Attestor, Auth, BinaryAnalysis, Compliance, Crypto, Environment,
EvidenceLocker, Notify, Observability, Operations, Policy, Postgres, Release,
Scanner, Storage, Vex) and their backing library counterparts (AI, Attestation,
Authority, Core, Cryptography, Database, Docker, Integration, Notify,
Observability, Security, ServiceGraph, Sources, Verification).

Each check now emits structured remediation metadata (severity, category,
runbook links, and fix suggestions) consumed by the Doctor dashboard
remediation panel.

Also adds:
- docs/doctor/articles/ knowledge base for check explanations
- Advisory AI search seed and allowlist updates for doctor content
- Sprint plan for doctor checks documentation

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2026-03-27 12:28:00 +02:00

1.6 KiB

Raw Blame History

checkId, plugin, severity, tags

checkId

plugin

severity

OCSP Stapling Enabled

What It Checks

Checks whether TSA OCSP stapling is configured and fresh. The check:

Queries the stapling status provider for all TSA providers.
Reports which providers have OCSP stapling enabled or disabled.
Fails if all providers have stapling disabled. Warns if some are disabled.
Reports degraded if no stapling status data is available.

Why It Matters

OCSP stapling embeds the OCSP response directly in the TLS handshake or timestamp token, eliminating the need for clients to perform live OCSP lookups. This is critical for air-gapped deployments where live OCSP lookups are impossible, and improves performance for all deployments.

Common Causes

OCSP stapling not configured for TSA providers
Stapling status monitoring not set up
TSA provider does not support stapling

How to Fix

Docker Compose

Enable OCSP stapling in TSA provider configuration:

environment:
  Timestamping__OcspStapling__Enabled: "true"

Bare Metal / systemd

Configure OCSP stapling in appsettings.json and ensure TSA providers support it.

Kubernetes / Helm

timestamping:
  ocspStapling:
    enabled: true

Verification

stella doctor run --check check.timestamp.ocsp.stapling

check.timestamp.ocsp.responder — checks OCSP responder availability
check.timestamp.evidence.tst.missing-stapling — detects timestamps without stapled data
check.timestamp.revocation.cache-fresh — checks revocation cache freshness

1.6 KiB Raw Blame History