Checking for required OCSP URLs

Help
1

Instead of going through the CSV file offered via this post, isn't it easier to check for the setting with grep -r must_staple /etc/letsencrypt/renewal. If you get no results, one should be safe, yes?!

Moreover, all renewals after January 30, 2025, should have failed, which is also a good indicator that one is safe here.

I am asking because a cert issued on April 5, 2025, emits http://r10.o.lencr.org as the OSCP URI, which is confusing me.

openssl s_client -connect wiki.bvrk.de:443 -servername wiki.bvrk.de </dev/null 2>/dev/null \
  | openssl x509 -noout -ocsp_uri
http://r10.o.lencr.org

Just checking if my quick and dirty assessment is correct. I do not relly understand much of the inner workings of certs and stuff. Cheers

2

You're safe!

The reason the blog post doesn't say to inspect /etc/letsencrypt/renewal is that not everyone has that directory: it is specific to Certbot, but there are many other ACME clients out there which use different on-disk storage locations and formats.

And don't worry about your openssl output: every cert (until May 7, and unless you request the tlsserver profile) contains an OCSP URI. You only have a problem if the cert also contains the OCSP Must-Staple extension, which yours does not.

7 Likes
3

Cool. Thanks a lot for your insight. I appreciate it a lot. Yeah, I only thought about my little cert environment run with certbot. :expressionless:

2 Likes