auto-ssl / auto-ssl/lua-resty-auto-ssl
OCSP response not successful (6: unauthorized)
- Dominant language
- Lua
- Stars
- 2k
- Forks
- 184
- PR merge metrics
- No merged PRs in 30d
Description
Over the last few days I've been encountering the following error
```
[lua] ssl_certificate.lua:260: set_response_cert(): auto-ssl: failed to set ocsp stapling for **xxx** - continuing anyway - failed to get ocsp response: failed to validate OCSP response (http://ocsp.int-x3.letsencrypt.org): OCSP response not successful (6: unauthorized), context: ssl_certificate_by_lua*, client: 37.233.4.76, server: 0.0.0.0:443
```
It looks like it's caused when a certificate expires and so we're unable to use OCSP stapling but I'm unsure why it is not renewed correctly in the first place.
```
nginx version: openresty/1.17.8.2
```
```
lua-resty-auto-ssl
0.13.1-1 (installed) - /usr/local/lib/luarocks/rocks
lua-resty-http
0.15-0 (installed) - /usr/local/lib/luarocks/rocks
```
For now I'm able to resolve by doing the following
1. Deleting the cert in redis
2. Deleting the local copy (/etc/resty-auto-ssl/letsencrypt/certs)
3. restart openresty
Does anyone have any guidance into what could be the issue?
Alternatively, would it be possible to disable OCSP stapling entirely?
Edit.
`renew_check_interval` is also not set so it should have the default value of one day
Contributor guide
No contributing guide indexed for this repository
Research direction
Start at ssl_certificate.lua:260 and trace the OCSP response validation and certificate renewal path for the reported OpenResty 1.17.8.2 and lua-resty-auto-ssl 0.13.1 setup. Compare the Redis certificate, the local /etc/resty-auto-ssl/letsencrypt/certs copy, and the default renew_check_interval behavior. Done means identifying why renewal or OCSP validation returns unauthorized and documenting whether OCSP stapling can be disabled.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- lua, nginx
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 28/100