3

I work for a company that runs round 2000 websites and a while back we enabled OCSP stapling in our server config. For the better part of a year this worked without issue, but in recent weeks we've been seeing sites using GoDaddy-issued certificates giving OSCP errors more and more frequently.

It's worth noting that we've "solved" the OCSP error problem by simply disabling stapling when an error occurred, but I'm wondering if this is happening to more people than just us, and if anyone knows why?

Improve this question
1
  • You should add this as your own answer and then accept it.
    – Steve
    Feb 24, 2022 at 22:32

1 Answer 1

Reset to default
3

The problem was that GoDaddy's OCSP responders were unreliable and connections were timing out.

It's been a long while, but I believe that the solution we landed on was to simply change Nginx's ssl_stapling_verify setting to off which had the net effect of just not applying stapling when the CA's OSCP responder was misbehaving.

Depending on which HTTPd you're using you may or may not have a similar option, or there might be something related to caching OCSP responses more aggressively.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.