OCSP responders r11.o.lencr.org and r3.o.lencr.org returning NXDOMAIN — OCSP stapling unavailable

Help
1

Hello,

We observe that the OCSP hosts referenced in our Let’s Encrypt certificates (for example r11.o.lencr.org and r3.o.lencr.org) are currently returning NXDOMAIN at public resolvers and via DoH. As a result our server cannot fetch OCSP responses and cannot provide OCSP stapling.

Context

  • Domain: koopgemak.eu / koopgemak.nl

  • Certificate issuer: Let’s Encrypt (R13)

  • Impact: nginx reports OCSP response: no response sent and OCSP stapling is not available. TLS itself continues to work.

Commands run and raw output from our VPS

  • OCSP URI extracted from certificate

text

$ openssl x509 -in /opt/psa/var/modules/letsencrypt/etc/archive/koopgemak.eu/fullchain1.pem -noout -ocsp_uri
http://r11.o.lencr.org

text

$ curl -sS -H 'accept: application/dns-json' 'https://cloudflare-dns.com/dns-query?name=r3.o.lencr.org&type=A'
{"Status":3,"TC":false,"RD":true,"RA":true,"AD":false,"CD":false,"Question":[{"name":"r3.o.lencr.org","type":1}],"Authority":[{"name":"lencr.org","type":6,"TTL":1681,"data":"owen.ns.cloudflare.com. dns.cloudflare.com. 2406304740 10000 2400 604800 1800"}]}

text

$ curl -sS -H 'accept: application/dns-json' 'https://dns.google/resolve?name=r3.o.lencr.org&type=A'
{"Status":3,"TC":false,"RD":true,"RA":true,"AD":false,"CD":false,"Question":[{"name":"r3.o.lencr.org.","type":1}],"Authority":[{"name":"lencr.org","type":6,"TTL":1536,"data":"owen.ns.cloudflare.com. dns.cloudflare.com. 2406304740 10000 2400 604800 1800"}]}

text

$ curl -sS -H 'accept: application/dns-json' 'https://cloudflare-dns.com/dns-query?name=r11.o.lencr.org&type=A'
{"Status":3,"TC":false,"RD":true,"RA":true,"AD":false,"CD":false,"Question":[{"name":"r11.o.lencr.org","type":1}],"Authority":[{"name":"lencr.org","type":6,"TTL":1477,"data":"owen.ns.cloudflare.com. dns.cloudflare.com. 2406304740 10000 2400 604800 1800"}]}
  • Direct OCSP query with OpenSSL fails

text

$ openssl ocsp -issuer /opt/psa/var/modules/letsencrypt/etc/archive/koopgemak.eu/chain1.pem \
  -cert /opt/psa/var/modules/letsencrypt/etc/archive/koopgemak.eu/cert1.pem \
  -url http://r11.o.lencr.org -resp_text -noverify

http://r11.o.lencr.org
Error querying OCSP responder
40A7B22009750000:error:10080002:BIO routines:BIO_lookup_ex:system lib:../crypto/bio/bio_addr.c:738:Name or service not known
  • nginx / s_client confirmation

text

$ echo | openssl s_client -connect koopgemak.eu:443 -status 2>/dev/null | sed -n '1,160p'
CONNECTED(00000003)
OCSP response: no response sent
...
Verify return code: 0 (ok)
  • Additional note: we captured DNS traffic with tcpdump while issuing queries; no usable UDP DNS responses were observed returning to our VPS during those captures. pcap available on request.

Additional observation

  • Public resolvers return the SOA owen.ns.cloudflare.com for lencr.org, but no A records for the OCSP hosts referenced above.

Questions

  1. Is this a planned change or maintenance on the lencr.org zone that removed or moved the OCSP hosts r11.o.lencr.org and r3.o.lencr.org?

  2. If planned, what are the recommended OCSP responder hostnames for current Let’s Encrypt R‑series certificates and is there an expected restoration time?

  3. If not planned, can you advise what went wrong and whether there is a recommended workaround for servers that currently cannot provide OCSP stapling?

Title: Evidence for OCSP NXDOMAIN issue (koopgemak.eu)

Summary:

  • OCSP URIs in cert: http://r11.o.lencr.org
  • Public resolvers and DoH return Status:3 (NXDOMAIN) for r11.o.lencr.org and r3.o.lencr.org
  • Direct OCSP queries fail with BIO_lookup_ex / Name or service not known
  • nginx reports "OCSP response: no response sent"
  • tcpdump captures show DNS queries leaving the VPS but no usable UDP DNS responses returning

Commands and outputs

  1. Certificate OCSP URI
    $ openssl x509 -in /opt/psa/var/modules/letsencrypt/etc/archive/koopgemak.eu/fullchain1.pem -noout -ocsp_uri
    http://r11.o.lencr.org

  2. DoH checks (Cloudflare and Google)
    $ curl -sS -H 'accept: application/dns-json' 'https://cloudflare-dns.com/dns-query?name=r3.o.lencr.org&type=A'
    {"Status":3,"TC":false,"RD":true,"RA":true,"AD":false,"CD":false,"Question":[{"name":"r3.o.lencr.org","type":1}],"Authority":[{"name":"lencr.org","type":6,"TTL":1681,"data":"owen.ns.cloudflare.com. dns.cloudflare.com. 2406304740 10000 2400 604800 1800"}]}

$ curl -sS -H 'accept: application/dns-json' 'https://dns.google/resolve?name=r3.o.lencr.org&type=A'
{"Status":3,"TC":false,"RD":true,"RA":true,"AD":false,"CD":false,"Question":[{"name":"r3.o.lencr.org.","type":1}],"Authority":[{"name":"lencr.org.","type":6,"TTL":1536,"data":"owen.ns.cloudflare.com. dns.cloudflare.com. 2406304740 10000 2400 604800 1800"}]}

$ curl -sS -H 'accept: application/dns-json' 'https://cloudflare-dns.com/dns-query?name=r11.o.lencr.org&type=A'
{"Status":3,"TC":false,"RD":true,"RA":true,"AD":false,"CD":false,"Question":[{"name":"r11.o.lencr.org","type":1}],"Authority":[{"name":"lencr.org","type":6,"TTL":1477,"data":"owen.ns.cloudflare.com. dns.cloudflare.com. 2406304740 10000 2400 604800 1800"}]}

  1. Direct OCSP query
    $ openssl ocsp -issuer /opt/psa/var/modules/letsencrypt/etc/archive/koopgemak.eu/chain1.pem
    -cert /opt/psa/var/modules/letsencrypt/etc/archive/koopgemak.eu/cert1.pem
    -url http://r11.o.lencr.org -resp_text -noverify

http://r11.o.lencr.org

Error querying OCSP responder
40A7B22009750000:error:10080002:BIO routines:BIO_lookup_ex:system lib:../crypto/bio/bio_addr.c:738:Name or service not known

  1. nginx / s_client confirmation
    $ echo | openssl s_client -connect koopgemak.eu:443 -status 2>/dev/null | sed -n '1,160p'
    CONNECTED(00000003)
    OCSP response: no response sent
    ...
    Verify return code: 0 (ok)

  2. dig quick checks
    $ dig r11.o.lencr.org +short
    [no output]

$ dig r3.o.lencr.org +short
[no output]

  1. tcpdump summary (performed while issuing DNS queries)
  • Captured UDP DNS queries from VPS to public resolvers for r11.o.lencr.org and r3.o.lencr.org
  • No corresponding UDP DNS responses with A records were observed returning to the VPS during the capture window
  • pcap file available on request (filename: dns_capture.pcap)
  1. Additional notes
  • Public resolvers indicate the SOA for lencr.org is owen.ns.cloudflare.com
  • This appears to be a lencr.org zone issue (OCSP hostnames not present in DNS), not a local DNS resolver or firewall issue on our side
  • TLS connections to koopgemak.eu succeed; only OCSP stapling is affected

End of evidence file.

2

Let's Encrypt discontinued OCSP over a year ago:

It seems unsurprising that they'd remove DNS records for their former responders.