checkId: check.timestamp.revocation.cache-fresh plugin: stellaops.doctor.timestamping severity: warn tags: [timestamping, revocation, cache, ocsp, crl, air-gap]

Revocation Cache Freshness

This Stella Ops Doctor check confirms that the locally cached OCSP responses and CRLs used to validate timestamping authority (TSA) certificates are recent enough to be trustworthy. It is most relevant to operators running air-gapped or policy-gated release pipelines, where the cache may be the only available source of certificate revocation status.

What It Checks

Checks that cached OCSP responses and CRLs are not stale. The check:

Queries the revocation cache for OCSP response and CRL snapshot timestamps.
Compares each cached item’s age against thresholds: OCSP max age (default 12 hours), CRL max age (default 7 days).
Fails if all cached items are stale. Warns if some are stale.
Passes if no cached data exists (optional) or all items are fresh.

Air-Gap Behavior

When the deployment is sealed by AirGap policy, or STELLAOPS_DOCTOR_OFFLINE_PROFILE=true forces Doctor offline mode, this check evaluates the local revocation cache only and annotates results with airGapSealed=true. It does not attempt to refresh OCSP or CRL data from external responders.

Sealed deployments should import fresh OCSP/CRL snapshots through the offline kit before running evidence verification. Runtime TTL defaults are OCSP 15 minutes and CRL 1 hour, with shorter nextUpdate values taking precedence.

Why It Matters

Stale revocation data means the system may accept certificates that have been revoked since the cache was last updated. For air-gapped environments that cannot perform live lookups, a fresh cache is the only source of revocation information.

Common Causes

Revocation cache refresh job not running
Network issues preventing OCSP/CRL fetches
Cache storage issues

How to Fix

Docker Compose

# Refresh revocation cache
docker exec <platform-container> stella revocation cache refresh

Bare Metal / systemd

stella revocation cache refresh

# Schedule automatic refresh
stella revocation cache schedule --ocsp-interval 6h --crl-interval 24h

Kubernetes / Helm

timestamping:
  revocationCache:
    ocspMaxAgeHours: 12
    crlMaxAgeDays: 7
    refreshSchedule: "0 */6 * * *"

Verification

stella doctor run --check check.timestamp.revocation.cache-fresh

OCSP Responder Availability (check.timestamp.ocsp.responder) — checks OCSP responder availability
CRL Distribution Point Availability (check.timestamp.crl.distribution) — checks CRL distribution point availability