OCSP error is taking down my site in firefox

It may be difficult to inspect this because it’s managed from cpanel, but is your Apache doing OCSP stapling?

Because having web browsers talk to an OCSP server for every new connection has negative privacy implications and can hurt reliability (sort of as you’re seeing here) there is a feature called OCSP stapling, where the OCSP response instead of being fetched from a server by each web browser, is fetched from the OCSP server periodically by the web server, and then it “staples” that to the certificates it sends over, so browsers get the same information (signed by the CA) but don’t have to make another connection to get it.

However, with OCSP stapling problems that used to definitely be with the OCSP server, now might be trouble on your web server. Apache is definitely capable of fetching a “try later” response and then stapling that to certificates and sending those over, which is, -ugh- I don’t know how they thought that option was helpful.

If you definitely have, or think you might have, OCSP stapling enabled, then short of disabling it, which may not be possible from cpanel, you could try restarting the Apache server itself if that’s possible and then try the site a couple of time, leaving a few seconds between each try ? I think that when it’s restarted it will fetch a fresh OCSP response and so it might get a good response this time.

Still awkward though, really all the major web servers need to do better at OCSP stapling. Nobody wants an expired or invalid OCSP response, and nobody wants to wait a few seconds after each restart for it to work properly.

1 Like