From dae34203b6166c3b67514e10dc034c17f51e8756 Mon Sep 17 00:00:00 2001
From: mathilde-cryptpad <156299270+mathilde-cryptpad@users.noreply.github.com>
Date: Tue, 11 Mar 2025 08:47:23 +0100
Subject: [PATCH] remove OCSP Stapling support as it's now deprecated by Let's
 Encrypt for security reasons

---
 docs/example-advanced.nginx.conf | 10 ----------
 docs/example.nginx.conf          | 10 ----------
 2 files changed, 20 deletions(-)

diff --git a/docs/example-advanced.nginx.conf b/docs/example-advanced.nginx.conf
index 64e226bcc..e9458dbab 100644
--- a/docs/example-advanced.nginx.conf
+++ b/docs/example-advanced.nginx.conf
@@ -89,16 +89,6 @@ server {
     # HSTS (ngx_http_headers_module is required) (63072000 seconds)
     add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;
 
-    # OCSP stapling
-    ssl_stapling on;
-    ssl_stapling_verify on;
-
-    # verify chain of trust of OCSP response using Root CA and Intermediate certs
-    ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt;
-
-    # replace with the IP address of your resolver
-    resolver 8.8.8.8 8.8.4.4 1.1.1.1 1.0.0.1 9.9.9.9 149.112.112.112 208.67.222.222 208.67.220.220;
-
     # OnlyOffice fonts may be loaded from both domains
     if ($uri ~ ^/common/onlyoffice/.*/fonts/) { set $allowed_origins "*"; }
 
diff --git a/docs/example.nginx.conf b/docs/example.nginx.conf
index eae30310a..23ccf2182 100644
--- a/docs/example.nginx.conf
+++ b/docs/example.nginx.conf
@@ -65,16 +65,6 @@ server {
     # HSTS (ngx_http_headers_module is required) (63072000 seconds)
     add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;
 
-    # OCSP stapling
-    ssl_stapling on;
-    ssl_stapling_verify on;
-
-    # verify chain of trust of OCSP response using Root CA and Intermediate certs
-    ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt;
-
-    # replace with the IP address of your resolver
-    resolver 8.8.8.8 8.8.4.4 1.1.1.1 1.0.0.1 9.9.9.9 149.112.112.112 208.67.222.222 208.67.220.220;
-
     location / {
         proxy_pass            http://localhost:3000;
         proxy_set_header      X-Real-IP $remote_addr;