auto-ssl / auto-ssl/lua-resty-auto-ssl

OCSP response not successful (6: unauthorized)

Open
#239 9 comments 0 reactions 0 assignees View on GitHub
Dominant language
Lua
Stars
2k
Forks
184
PR merge metrics
No merged PRs in 30d

Description

Over the last few days I've been encountering the following error

```
[lua] ssl_certificate.lua:260: set_response_cert(): auto-ssl: failed to set ocsp stapling for **xxx** - continuing anyway - failed to get ocsp response: failed to validate OCSP response (http://ocsp.int-x3.letsencrypt.org): OCSP response not successful (6: unauthorized), context: ssl_certificate_by_lua*, client: 37.233.4.76, server: 0.0.0.0:443
```

It looks like it's caused when a certificate expires and so we're unable to use OCSP stapling but I'm unsure why it is not renewed correctly in the first place.

```
nginx version: openresty/1.17.8.2
```
```
lua-resty-auto-ssl
0.13.1-1 (installed) - /usr/local/lib/luarocks/rocks

lua-resty-http
0.15-0 (installed) - /usr/local/lib/luarocks/rocks

```

For now I'm able to resolve by doing the following

1. Deleting the cert in redis
2. Deleting the local copy (/etc/resty-auto-ssl/letsencrypt/certs)
3. restart openresty

Does anyone have any guidance into what could be the issue?
Alternatively, would it be possible to disable OCSP stapling entirely?

Edit.
`renew_check_interval` is also not set so it should have the default value of one day

Contributor guide

No contributing guide indexed for this repository

Research direction

Start at ssl_certificate.lua:260 and trace the OCSP response validation and certificate renewal path for the reported OpenResty 1.17.8.2 and lua-resty-auto-ssl 0.13.1 setup. Compare the Redis certificate, the local /etc/resty-auto-ssl/letsencrypt/certs copy, and the default renew_check_interval behavior. Done means identifying why renewal or OCSP validation returns unauthorized and documenting whether OCSP stapling can be disabled.

Written by the indexing model from the issue text.

Assessment

Tech stack
lua, nginx
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
28/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.