GoDaddy OCSP issues

Question

I work for a company that runs round 2000 websites and a while back we enabled OCSP stapling in our server config. For the better part of a year this worked without issue, but in recent weeks we've been seeing sites using GoDaddy-issued certificates giving OSCP errors more and more frequently.

It's worth noting that we've "solved" the OCSP error problem by simply disabling stapling when an error occurred, but I'm wondering if this is happening to more people than just us, and if anyone knows why?

Answer 1

The problem was that GoDaddy's OCSP responders were unreliable and connections were timing out.

It's been a long while, but I believe that the solution we landed on was to simply change Nginx's ssl_stapling_verify setting to off which had the net effect of just not applying stapling when the CA's OSCP responder was misbehaving.

Depending on which HTTPd you're using you may or may not have a similar option, or there might be something related to caching OCSP responses more aggressively.