auto-ssl / auto-ssl/lua-resty-auto-ssl

Failed to set ocsp stapling

Open
#168 10 comments 0 reactions 0 assignees View on GitHub
Dominant language
Lua
Stars
2k
Forks
184
PR merge metrics
No merged PRs in 30d

Description

Hello

We have domain with expired certificat that are not renew with this error in the log

``` 2019/02/15 12:07:32 [error] 18188#18188: *29843 [lua] ssl_certificate.lua:255: set_response_cert(): auto-ssl: failed to set ocsp stapling for insecticide-spray.com - continuing anyway - failed to get ocsp response: failed to validate OCSP response (http://ocsp.int-x3.letsencrypt.org): OCSP_check_validity() failed, context: ssl_certificate_by_lua*, client: 92.184.96.115, server: 0.0.0.0:443 ```

The only solution to force the renew is to delete the directory of this domain in the certs directory and to restart openresty.

Do you have a solution ?

Thank you

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the logged failure at ssl_certificate.lua:255 and inspect how the domain's certificate directory is handled during OCSP stapling and renewal. Reproduce the expired-certificate case using the reported error path and an OpenResty restart; done means renewal succeeds without manually deleting the domain directory.

Written by the indexing model from the issue text.

Assessment

Tech stack
lua, nginx
Domain
backend, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.