There has been several complaints today that the latest Chrome can’t connect some sites using Let’s Encrypt certificates. I narrowed it down to the OCSP – all sites in question get an expired response from OCSP serve (for example kvlt.ee ): $ openssl ocsp -header "HOST" ocsp.int-x3.letsencrypt.org -…

As a quick, temporary fix for people in this thread: This issue only affects updating of old OCSP responses, not generation of new ones. So if you reissue your certificate you’ll get a fresh response you can staple. We’re still working as fast as we can to get OCSP signing caught up, but it may tak…

Well, this sucks for Must Staple certificates, even with the workaround of issuing new certs :disappointed:

[image] Grovespaz: I've requested new certificates for all important domains and those seem to work for now.. Not sure how feasible that is for everyone. Also confirmed this workaround. Thanks.

[image] hasso: No browser interprets an expired OCSP response as a failure, seems. I'm now seeing SEC_ERROR_OCSP_OLD_RESPONSE error in Firefox 50.0.2 for my website. This error cannot be dismissed without going into about:config, which makes the website essentially unreachable. I checked aga…

@avian2 : What’s your site? Update for everyone: We’re very close to catching up an all expired OCSP. There’s about 47 minutes of catchup left to be done. Again, my apologies for the outage.

We’ve brought all the expired OCSP responses up to date, and this problem should be fixed. If it’s not showing as fixed for you, you may need to get your web server to pull an updated OCSP response for stapling. If that still doesn’t work, please let me know and we’ll investigate further. We’ll be …

Very likely you’ve thought of all this, but two immediate thoughts pop into my head, as someone who isn’t using Let’s Encrypt on anything critical but has had “get woken in the middle of the night” level responsibility for systems using certificates from somebody else for more than a decade. One …

These are some good ideas, thanks!

OCSP server sending expired responses + stapling breaks Chrome

Help

jsha December 18, 2016, 4:23am 57

Incident report is now posted: Expired OCSP responses, December 12. Thanks for checking in, @Osiris!

Topic		Replies	Views
OCSP Request failed with following message Help	77	16988	February 22, 2018
SSL stapling OCSP error Help	14	7604	December 11, 2017
What is the relationship between the revoking list and OCSP Stapling? Site Feedback	44	4820	February 4, 2022
Expired OCSP responses, December 12 Incidents	5	6191	December 19, 2016
Sunsetting of OCSP in favor of older technology? Issuance Policy	23	3108	August 1, 2024

OCSP server sending expired responses + stapling breaks Chrome

Related topics