# No OCSP URL available **URL:** \ **Category:** Help\ **Created:** [June 2, 2025, 6:28pm UTC](https://community.letsencrypt.org/t/no-ocsp-url-available/238085 "2025-06-02T18:28:33Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![pleo87508](https://avatars.discourse-cdn.com/v4/letter/p/d26b3c/32.png) [@pleo87508](https://community.letsencrypt.org/u/pleo87508)\ **Post date:** [June 2, 2025, 6:28pm UTC](https://community.letsencrypt.org/t/no-ocsp-url-available/238085/1 "2025-06-02T18:28:33Z")
Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [crt.sh | example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help. My domain is: [hhdw.org](http://hhdw.org) I ran this command: After running Apache httdp server-status - in the section labeled Managed Certificates, I saw the following output: Domain: [hhdw.org](http://hhdw.org) Names: [hhdw.org](http://hhdw.org) Status: good Valid: until 2025-08-18 CA: LetsEncrypt ([https://acme-v02.api.letsencrypt.org/directory](https://acme-v02.api.letsencrypt.org/directory)) Stapling: on CheckAt: |[crt.sh[rsa]][crt.sh | 7d33c82e88f4f3f1653aa861ace9f0464f139f31445c66be6ff1bebcb080224c](https://crt.sh/?q=7d33c82e88f4f3f1653aa861ace9f0464f139f31445c66be6ff1bebcb080224c) Activity: Renew 2025-07-10| I clicked on the crt.sh URL above When the crt.sh URL came up, under Revocation section, for OCSP Mechanism/status, there was another URL which I ran: > **[crt.sh | 18518985441](https://crt.sh/?id=18518985441&opt=ocsp)** > > Free CT Log Certificate Search Tool from Sectigo (formerly Comodo CA) It produced this output: Mechanism: OCSP Provider The CA Status **No OCSP URL available** Last Observed in CRL - n/a Last Checked (error) 2025-06-06 16:11:17 UTC My web server is (include version): Apache 2.4.63, with mod-status The operating system my web server runs on is (include version): MS Windows Server 2019 datacenter My hosting provider, if applicable, is: I can login to a root shell on my machine (yes or no, or I don't know): YES I'm using a control panel to manage my site (no, or provide the name and version of the control panel): NO Here's some of my configuration: snippet from httpd-vhosts.conf ``` ServerName hhdw.org #### use http2, and permit acme to just use 443 Protocols h2 http/1.1 acme-tls/1 ErrorLog "logs/hhdw_443_error.log" CustomLog "logs/hhdw_443_access_%Y%m%d.log" combined SSLEngine on SSLInsecureRenegotiation off SSLProxyEngine on SSLProxyVerify none SSLProxyCheckPeerCN off SSLProxyCheckPeerExpire off SSLProxyCheckPeerName off #### Reverse proxy for this virtual host #### ProxyPreserveHost on ProxyRequests off Require all granted ``` Header always edit Set-Cookie ^(.\*)$ $1;HttpOnly;Secure RequestHeader set X-Forwarded-Proto "https" RequestHeader set X-Forwarded-Port "443" ``` ProxyPass "/server-status" "!" ProxyPass "/md-status" "!" ProxyPass "/.svn" "!" ProxyPass "/nmibis-admin" "!" ProxyPass "/xmlrpc.php" "!" ProxyPass "/wp-cron.php" "!" ###ProxyPass "/wp-login.php" "!" #### ProxyPass /report/ http://10.0.1.108/report/ ProxyPassReverse /report/ http://10.0.1.108/report/ ProxyPassReverseCookieDomain 10.0.1.108/report/ /report/ ProxyPassReverseCookiePath "/report/" "/report/" ProxyPass / http://10.0.1.108/ ProxyPassReverse / http://10.0.1.108/ ProxyPassReverseCookiePath "/" "/" Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains" ``` For httpd-ssl.conf everything is commented out except for: SSLCipherSuite \< list of acceptable ciphers\> SSLHonorCipherOrder on SSLProtocol +TLSv1.2 +TLSv1.3 SSLProxyProtocol +TLSv1.2 +TLSv1.3 Note: I don't have SSLUseStapling set to on, because as I understand it, when using mod\_md, it provides its only stapling method Why am I seeing the **No OCSP URL available** in the Statud of the crt.sh output, after running check ---
**Author:** ![ghen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/ghen/32/49729_2.png) [@ghen](https://community.letsencrypt.org/u/ghen)\ **Post date:** [June 2, 2025, 6:31pm UTC](https://community.letsencrypt.org/t/no-ocsp-url-available/238085/2 "2025-06-02T18:31:08Z")
Welcome back! Please see here: [Ending OCSP Support in 2025 - Let's Encrypt](https://letsencrypt.org/2024/12/05/ending-ocsp/) ---
**Author:** ![pleo87508](https://avatars.discourse-cdn.com/v4/letter/p/d26b3c/32.png) [@pleo87508](https://community.letsencrypt.org/u/pleo87508)\ **Post date:** [June 2, 2025, 6:46pm UTC](https://community.letsencrypt.org/t/no-ocsp-url-available/238085/3 "2025-06-02T18:46:43Z")
Thanks for such a rapid response. So now some questions, excuse my ignorance: It sounds like the revocation is more critical for VPN use, correct? If my application is purely a website running on SSL, it sounds like I don't need to be concerned, correct? Finally is there anything I need to do with my current configuration? I searched a little more after reading articles, but could not find any information. ---
**Author:** ![petercooperjr](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/petercooperjr/32/84698_2.png) [@petercooperjr](https://community.letsencrypt.org/u/petercooperjr)\ **Post date:** [June 2, 2025, 7:03pm UTC](https://community.letsencrypt.org/t/no-ocsp-url-available/238085/4 "2025-06-02T19:03:48Z")
> [@pleo87508](#): > > It sounds like the revocation is more critical for VPN use, correct? Uh, no? I'm not sure what you're getting at. Let's Encrypt is still revoking certificates if needed, just using CRL rather than OCSP. > [@pleo87508](#): > > If my application is purely a website running on SSL, it sounds like I don't need to be concerned, correct? > Finally is there anything I need to do with my current configuration? The only thing you might need to change on your website configurating is turning off OCSP stapling if you previously had it on. Are you actually experiencing an issue? Are you just looking up your certificate and seeing that it doesn't have OCSP information and getting confused by that, or is there something you're seeing that isn't working right? ---
**Author:** ![EinKantHolz](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/einkantholz/32/85590_2.png) [@EinKantHolz](https://community.letsencrypt.org/u/EinKantHolz)\ **Post date:** [June 3, 2025, 10:26am UTC](https://community.letsencrypt.org/t/no-ocsp-url-available/238085/5 "2025-06-03T10:26:28Z")
Same or similiar problem here. I have nginx Proxy manager running with a wildcard LE cert and Cloudflare for a lot of domains. It affects Bitwarden, Nextcloud and more. all on Firefox no longer reachable. But Opera, Edge and so on are working. What must I do? ---
**Author:** ![EinKantHolz](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/einkantholz/32/85590_2.png) [@EinKantHolz](https://community.letsencrypt.org/u/EinKantHolz)\ **Post date:** [June 3, 2025, 10:33am UTC](https://community.letsencrypt.org/t/no-ocsp-url-available/238085/6 "2025-06-03T10:33:21Z")
And it also affects Thunderbird and Bitwarden (app) not only the web-based frontend ---
**Author:** ![petercooperjr](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/petercooperjr/32/84698_2.png) [@petercooperjr](https://community.letsencrypt.org/u/petercooperjr)\ **Post date:** [June 3, 2025, 10:58am UTC](https://community.letsencrypt.org/t/no-ocsp-url-available/238085/7 "2025-06-03T10:58:09Z")
You should start your own thread in the Help section, filling out the questionnaire with information on your domain name and how you requested and installed the Let's Encrypt certificate. It's highly unlikely that whatever issue you're experiencing is related to OCSP URLs no longer being in Let's Encrypt's certificates. ---
**Author:** ![pleo87508](https://avatars.discourse-cdn.com/v4/letter/p/d26b3c/32.png) [@pleo87508](https://community.letsencrypt.org/u/pleo87508)\ **Post date:** [June 3, 2025, 3:10pm UTC](https://community.letsencrypt.org/t/no-ocsp-url-available/238085/8 "2025-06-03T15:10:57Z")
> [@pleo87508](#): > > Note: I don't have SSLUseStapling set to on, because as I understand it, when using mod\_md, it provides its only stapling method There doesn't seem to be any issue that I can see. SSL Labs reports A+ rating. It was just that I was receiving No OSCP URL available, and I now understand that this is no longer supported. As, I said in my original post, I don't have SSLUseStapling set to on, because as I understand it, when using mod\_md, it provides its only stapling method. So there doesn't seem to be any issue, and it sounds like since I do not have use stapling turned on that I don't need to do anything, correct? SSL Labs gives me a URL for the CRL revocation information. Is there a program available that I can use to parse that? ---
**Author:** ![petercooperjr](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/petercooperjr/32/84698_2.png) [@petercooperjr](https://community.letsencrypt.org/u/petercooperjr)\ **Post date:** [June 3, 2025, 3:16pm UTC](https://community.letsencrypt.org/t/no-ocsp-url-available/238085/9 "2025-06-03T15:16:20Z")
> [@pleo87508](#): > > So there doesn't seem to be any issue, and it sounds like since I do not have use stapling turned on that I don't need to do anything, correct? Correct. > [@pleo87508](#): > > SSL Labs gives me a URL for the CRL revocation information. > > Is there a program available that I can use to parse that? To just, like, look at a CRL? It won't really do you a whole lot of good, it's basically just a list of certificate serial numbers to not trust anymore. But sure. If you download it, in Windows you can just double-click it to look at its properties and the list of revoked serial numbers. Or on systems with openssl, you can run something like `openssl crl -in 41.crl -text -noout` to view what's in it. ---
**Author:** ![pleo87508](https://avatars.discourse-cdn.com/v4/letter/p/d26b3c/32.png) [@pleo87508](https://community.letsencrypt.org/u/pleo87508)\ **Post date:** [June 3, 2025, 3:24pm UTC](https://community.letsencrypt.org/t/no-ocsp-url-available/238085/10 "2025-06-03T15:24:15Z")
It is encrypted so I will use the openssl command. So it sounds like, at least at this point everything is fine, and in retrospect, if I had known about the phasing out of OCSP, that I had/have nothing to worry about, Correct? AND THANKS FOR you help and prompt replies!!! ---
**Author:** ![petercooperjr](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/petercooperjr/32/84698_2.png) [@petercooperjr](https://community.letsencrypt.org/u/petercooperjr)\ **Post date:** [June 3, 2025, 3:27pm UTC](https://community.letsencrypt.org/t/no-ocsp-url-available/238085/11 "2025-06-03T15:27:08Z")
> [@pleo87508](#): > > It is encrypted so I will use the openssl command. It's technically just signed, not encrypted (there's nothing secret in there that you need a key in order to decode, just a key to confirm it's from the author you think it is). But it is in a binary format that won't make much sense without using a program that understands the CRL format, sure. > [@pleo87508](#): > > So it sounds like, at least at this point everything is fine, and in retrospect, if I had known about the phasing out of OCSP, that I had/have nothing to worry about, Correct? Yes. Nothing is wrong, everything is fine, there is no need to panic. > [@pleo87508](#): > > AND THANKS FOR you help and prompt replies!!! You're very welcome! ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [June 3, 2025, 3:36pm UTC](https://community.letsencrypt.org/t/no-ocsp-url-available/238085/12 "2025-06-03T15:36:31Z")
> [@pleo87508](#): > > As, I said in my original post, I don't have SSLUseStapling set to on, because as I understand it, when using mod\_md, it provides its only stapling method Just adding clarity about mod\_md stapling ... mod\_md offers its own OCSP stapling method (MDStapling) as an _alternative_ to the one in mod\_ssl. But, it is disabled by default. Even if you had MDStapling enabled mod\_md just skips the certificate if it has no OCSP URL. See: [Proper mod\_md configuration for LE no longer supporting OCSP · Issue #367 · icing/mod\_md · GitHub](https://github.com/icing/mod_md/issues/367#issuecomment-2619075938) In short, nothing you need to worry about 🙂 For reference, the MDStapling docs are here: [mod\_md - Apache HTTP Server Version 2.4](https://httpd.apache.org/docs/2.4/mod/mod_md.html#mdstapling) ---
**Author:** ![pleo87508](https://avatars.discourse-cdn.com/v4/letter/p/d26b3c/32.png) [@pleo87508](https://community.letsencrypt.org/u/pleo87508)\ **Post date:** [June 3, 2025, 3:37pm UTC](https://community.letsencrypt.org/t/no-ocsp-url-available/238085/13 "2025-06-03T15:37:45Z")
Thanks, again! ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [July 3, 2025, 3:38pm UTC](https://community.letsencrypt.org/t/no-ocsp-url-available/238085/14 "2025-07-03T15:38:08Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.