China GWF block ocsp server ip

[rg305]

@GodSir

Does anyone know what is the reason for this problem? how to fix this

Have you read post #8?:

@Osiris

Your current cert (crt.sh | 7554475879 ) has "must staple" enabled (" TLS Feature:
status_request" in the certificate info from crt.sh/OpenSSL).

When "must staple" is enabled, well, the browser expects a stapled OCSP status. If that won't succeed, it gives the error you've shown.

Fixes:

• make sure OCSP stapeling is working (note that a stapled OCSP status is different from a separate OCSP request made by the browser. The stapled OCSP status is provided by the webserver in the handshake and should also be configured in the webserver)
• if OCSP stapeling is not possible: disable the "must staple" feature in your certificate.