OCSP error is taking down my site in firefox

Aha. Apache documents that it will “fake” a tryLater response if its own OCSP resolver doesn’t succeed by default.

“Default: SSLStaplingFakeTryLater on”

Again I have no idea who thought this is helpful. But it could mean that the problem is with some network configuration for your server, which forbids it from accessing the OCSP server even though that server works for everybody else.

The easiest fix may be to disable stapling. Or at least set SSLStaplingReturnResponderErrors off so that when the Apache server has no good answers it shuts up rather than stapling errors.

In some sense a “better” fix may be to investigate and fix the network configuration. But you may have restricted network access for good reasons.

3 Likes