OCSP response not successful (6: unauthorized) while requesting certificate status, responder: r3.o.lencr.org, peer: 23.43.85.142:80, certificate: "/etc/letsencrypt/live/hippocampusanalytics.com/fullchain.pem"

Help
1

Hello,

My website stopped working and now gives the scary warning (Warning: Potential Security Risk Ahead)

I have updated certbot and tried to install the ubuntu authenticator per these instructions ubuntu - How to update Certbot version? - Stack Overflow
I have updated everything that I can think of.
I have an ssl-renew script and manually ran that.
I am still getting the same error.

#!/bin/bash

COMPOSE="/usr/bin/docker-compose --no-ansi"
DOCKER="/usr/bin/docker"

cd /home/weilidma/dsp-ui
$COMPOSE run nginx renew && $COMPOSE kill -s SIGHUP nginx
$DOCKER system prune -af

My domain is:
hippocampusanalytics.com

My web server is (include version):
nginx
ubuntu 20.04
certbot 1.20.0
GoDaddy

2

Your site is currently serving a Let's Encrypt certificate that has expired on Oct 31.

You have issued a new certificate very recently, but your webserver is not serving it. This is an indication that the certificate was not installed correctly. Sometimes all that's needed is a reload of the webserver in question. If that doesn't help, we need to see your nginx configuration (which can usually be done via nginx -T).

3 Likes
3

Thank you!!

Restarted everything and it works :slight_smile:

I had an autorenew script running. Can you please tell me:

  1. Why did that stop working?

  2. Which of the solutions is the one that worked?

4 Likes
4

I usually need my crystal ball for this and sadly that's currently in the workshop for repairs, which reduces me to a mere mortal.

All I can see on crt.sh are some renewals that don't look like the usual 60-days renewal period. crt.sh | hippocampusanalytics.com

So I'm not sure how your renewal script is supposed to work in the first place. If you could show us some details about it we might learn more about what went wrong.

I guess (again, hard to tell without crystal ball) that your renew script did renew the certificate as expected (though not automatic), but did not reload the webserver, which is necessary to install the new certificate.

2 Likes
5

HA :smiley:

I hope your crystal ball will be ok.

my renewal script is above (reposted here) and was modeled after these instructions How To Secure a Containerized Node Application with Let's Encrypt | DigitalOcean

#!/bin/bash

COMPOSE="/usr/bin/docker-compose --no-ansi"
DOCKER="/usr/bin/docker"

cd /home/weilidma/dsp-ui
$COMPOSE run nginx renew && $COMPOSE kill -s SIGHUP nginx
$DOCKER system prune -af

Now that you mention it, I see no reference to Certbot at all, so I am not certain how it was working... yet it was. Can you tell me how to make this work or point me to instructions?

6

That seems to be a script that runs some (nginx) docker container. Sorry, can't really tell what it does exactly.

2 Likes
7

d'oh..... it was referring to the wrong container (nginx as versus certbot). I am STILL not certain how it was working before, but I am satisfied. Thank you for your help!

2 Likes
8

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.