auto-ssl / auto-ssl/lua-resty-auto-ssl
Failed to set ocsp stapling
- Dominant language
- Lua
- Stars
- 2k
- Forks
- 184
- PR merge metrics
- No merged PRs in 30d
Description
Hello
We have domain with expired certificat that are not renew with this error in the log
``` 2019/02/15 12:07:32 [error] 18188#18188: *29843 [lua] ssl_certificate.lua:255: set_response_cert(): auto-ssl: failed to set ocsp stapling for insecticide-spray.com - continuing anyway - failed to get ocsp response: failed to validate OCSP response (http://ocsp.int-x3.letsencrypt.org): OCSP_check_validity() failed, context: ssl_certificate_by_lua*, client: 92.184.96.115, server: 0.0.0.0:443 ```
The only solution to force the renew is to delete the directory of this domain in the certs directory and to restart openresty.
Do you have a solution ?
Thank you
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with the logged failure at ssl_certificate.lua:255 and inspect how the domain's certificate directory is handled during OCSP stapling and renewal. Reproduce the expired-certificate case using the reported error path and an OpenResty restart; done means renewal succeeds without manually deleting the domain directory.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- lua, nginx
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100