diff --git a/docs/root/version_history/current.rst b/docs/root/version_history/current.rst index 243facceaed48..0eb10995c0879 100644 --- a/docs/root/version_history/current.rst +++ b/docs/root/version_history/current.rst @@ -50,6 +50,7 @@ Removed Config or Runtime * http: removed ``envoy.reloadable_features.allow_preconnect`` runtime guard and legacy code paths. * listener: removed ``envoy.reloadable_features.disable_tls_inspector_injection`` runtime guard and legacy code paths. * ocsp: removed ``envoy.reloadable_features.check_ocsp_policy deprecation`` runtime guard and legacy code paths. +* ocsp: removed ``envoy.reloadable_features.require_ocsp_response_for_must_staple_certs deprecation`` and legacy code paths. New Features ------------ diff --git a/source/common/runtime/runtime_features.cc b/source/common/runtime/runtime_features.cc index b828b76476f19..f2895308dc87b 100644 --- a/source/common/runtime/runtime_features.cc +++ b/source/common/runtime/runtime_features.cc @@ -81,7 +81,6 @@ constexpr const char* runtime_features[] = { "envoy.reloadable_features.prefer_quic_kernel_bpf_packet_routing", "envoy.reloadable_features.preserve_downstream_scheme", "envoy.reloadable_features.remove_forked_chromium_url", - "envoy.reloadable_features.require_ocsp_response_for_must_staple_certs", "envoy.reloadable_features.require_strict_1xx_and_204_response_headers", "envoy.reloadable_features.return_502_for_upstream_protocol_errors", "envoy.reloadable_features.send_strict_1xx_and_204_response_headers", diff --git a/source/extensions/transport_sockets/tls/context_impl.cc b/source/extensions/transport_sockets/tls/context_impl.cc index ae36610004e8e..f8870d4dddc88 100644 --- a/source/extensions/transport_sockets/tls/context_impl.cc +++ b/source/extensions/transport_sockets/tls/context_impl.cc @@ -777,9 +777,7 @@ ServerContextImpl::ServerContextImpl(Stats::Scope& scope, auto& ocsp_resp_bytes = tls_certificates[i].get().ocspStaple(); if (ocsp_resp_bytes.empty()) { - if (Runtime::runtimeFeatureEnabled( - "envoy.reloadable_features.require_ocsp_response_for_must_staple_certs") && - ctx.is_must_staple_) { + if (ctx.is_must_staple_) { throw EnvoyException("OCSP response is required for must-staple certificate"); } if (ocsp_staple_policy_ == Ssl::ServerContextConfig::OcspStaplePolicy::MustStaple) { diff --git a/test/extensions/transport_sockets/tls/context_impl_test.cc b/test/extensions/transport_sockets/tls/context_impl_test.cc index 72bff36b463bd..04a1a72d882ed 100644 --- a/test/extensions/transport_sockets/tls/context_impl_test.cc +++ b/test/extensions/transport_sockets/tls/context_impl_test.cc @@ -623,23 +623,6 @@ TEST_F(SslServerContextImplOcspTest, TestMustStapleCertWithoutStapleConfigFails) "OCSP response is required for must-staple certificate"); } -TEST_F(SslServerContextImplOcspTest, TestMustStapleCertWithoutStapleFeatureFlagOff) { - const std::string tls_context_yaml = R"EOF( - common_tls_context: - tls_certificates: - - certificate_chain: - filename: "{{ test_rundir }}/test/extensions/transport_sockets/tls/ocsp/test_data/revoked_cert.pem" - private_key: - filename: "{{ test_rundir }}/test/extensions/transport_sockets/tls/ocsp/test_data/revoked_key.pem" - ocsp_staple_policy: lenient_stapling - )EOF"; - - TestScopedRuntime scoped_runtime; - Runtime::LoaderSingleton::getExisting()->mergeValues( - {{"envoy.reloadable_features.require_ocsp_response_for_must_staple_certs", "false"}}); - loadConfigYaml(tls_context_yaml); -} - TEST_F(SslServerContextImplOcspTest, TestGetCertInformationWithOCSP) { const std::string yaml = R"EOF( common_tls_context: