4 ms·
Not only is it a problem with certificate issuance - but their OCSP servers are also down. This caused an issue on one of my sites where I was using OCSP Stapli
by QUFB 9y ago
Not only is it a problem with certificate issuance - but their OCSP servers are also down. This caused an issue on one of my sites where I was using OCSP Stapling: normal browser connections were failing, but not tools like curl (which don't ask for the OCSP response over SSL).
- Ajedi32 9y agoWhat's the typical validity period for OCSP responses with Let's Encrypt? Shouldn't the stapled responses continue working for at least a couple hours even after Let's Encrypt goes down?
- agrajag 9y ago1 week, so most servers likely won't be affected unless the outage goes on for a really long time.
- avian 9y agoNot sure how this works. I have OCSP stapling turned on in Apache and Firefox wouldn't load my page when Let's Encrypt OCSP servers went down. My monitoring shows that last stapled response had 4 days of validity left. So it seems that Apache immediately threw away cached OCSP responses.
- Ajedi32 9y agoYeah, seems like Apache handles OCSP server outages pretty poorly. See: https://news.ycombinator.com/item?id=14375334 https://news.ycombinator.com/item?id=14375334
- mholt 9y agoFor what it's worth, Caddy is the only server that will locally cache the staples (and manage them) automatically. In other words, Caddy sites were not affected by this OCSP downtime.
- pritambaral 9y agoWhile we're on the topic: https://github.com/mholt/caddy/issues/1680 https://github.com/mholt/caddy/issues/1680
- pritambaral 9y agoWhile we're on the topic: https://github.com/mholt/caddy/issues/1680 https://github.com/mholt/caddy/issues/1680