OCSP server returns unauthorized status

Thanks for the report! This was related to a recent outage: https://letsencrypt.status.io/pages/incident/55957a99e800baa4470002da/5816da347170c62119001f43. We’ll be writing up a full report soon, but the short version is that our database was overloaded, and we use the same database to serve OCSP queries. We’ll work to improve reliability in the future.

You may be interested to read these gists about the ways in which OCSP stapling is implemented suboptimally in Apache and Nginx: https://gist.github.com/AGWA/1de6c26be5396f7cbce7ee016302d684 and https://gist.github.com/sleevi/5efe9ef98961ecfb4da8. Ideally your web server (looks like Apache) would keep the latest OCSP response around until it could be replaced by a fresher one. If that were the case, any outage shorter than ~3.5 days could be weathered safely, even with a Must-Staple cert. Unfortunately, Apache drops its cached OCSP response after an hour, which means that any OCSP responder outage can cause an outage in your site.

My apologies for the downtime!

4 Likes