Remove ocsp-responder (#8344)

Delete all code for ocsp-responder. Delete all code for rocsp-tool.
Remove the Redis instances designated for OCSP caching. Delete
OCSP-specific integration tests, and update revocation tests to rely
only on CRLs. Update documentation to reference CRLs instead of OCSP.

Follow-up changes will remove the RA's and CA's OCSP-signing code paths,
now that they have no callers.

Fixes #8172

Author: aarongable

README.md

@@ -30,11 +30,10 @@ Boulder is divided into the following main components:
 4. Certificate Authority
 5. Storage Authority
 6. Publisher
-7. OCSP Responder
-8. CRL Updater
+7. CRL Updater
 
 This component model lets us separate the function of the CA by security
-context. The Web Front End, Validation Authority, OCSP Responder and
+context. The Web Front End, Validation Authority, CRL Storer, and
 Publisher need access to the Internet, which puts them at greater risk of
 compromise. The Registration Authority can live without Internet
 connectivity, but still needs to talk to the Web Front End and Validation
@@ -50,7 +49,7 @@ lines indicating SA RPCs are not shown here.
                              |               ^
 Subscriber server <- VA <----+               |
                                              |
-          Browser -------------------> OCSP Responder
+          Browser -----> S3 <----- CRL Storer/Updater
 ```
 
 Internally, the logic of the system is based around five types of objects:

cmd/boulder/main.go

@@ -21,10 +21,8 @@ import (
 	_ "github.com/letsencrypt/boulder/cmd/email-exporter"
 	_ "github.com/letsencrypt/boulder/cmd/log-validator"
 	_ "github.com/letsencrypt/boulder/cmd/nonce-service"
-	_ "github.com/letsencrypt/boulder/cmd/ocsp-responder"
 	_ "github.com/letsencrypt/boulder/cmd/remoteva"
 	_ "github.com/letsencrypt/boulder/cmd/reversed-hostname-checker"
-	_ "github.com/letsencrypt/boulder/cmd/rocsp-tool"
 	_ "github.com/letsencrypt/boulder/cmd/sfe"
 	"github.com/letsencrypt/boulder/core"
 

cmd/crl-updater/main.go

@@ -79,8 +79,7 @@ type Config struct {
 		// This should be set to the current set of serial prefixes in production.
 		// When deploying explicit sharding (i.e. the CRLDistributionPoints extension),
 		// the CAs should be configured with a new set of serial prefixes that haven't
-		// been used before (and the OCSP Responder config should be updated to
-		// recognize the new prefixes as well as the old ones).
+		// been used before.
 		TemporallyShardedSerialPrefixes []string
 
 		// MaxParallelism controls how many workers may be running in parallel.