I am having trouble with the 'certbot certificates -vvv' command on Centos 8 that is yielding and ssl oscp error related to the timeout flag. When the timeout flag is removed, there is no error. Running 'certbot certificates -vvv' yields (my domain replaced with www.example.com in the output):
Root logging level set at -10
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Querying OCSP for /etc/letsencrypt/live/www.example.com/cert.pem
openssl ocsp -no_nonce -issuer /etc/letsencrypt/live/www.example.com/chain.pem -cert /etc/letsencrypt/live/www.example.com/cert.pem -CAfile /etc/letsencrypt/live/www.example.com/chain.pem -verify_other /etc/letsencrypt/live/www.example.com/chain.pem -trust_other -timeout 10 -header Host=r3.o.lencr.org -url http://r3.o.lencr.org
Error while running openssl ocsp -no_nonce -issuer /etc/letsencrypt/live/www.example.com/chain.pem -cert /etc/letsencrypt/live/www.example.com/cert.pem -CAfile /etc/letsencrypt/live/www.example.com/chain.pem -verify_other /etc/letsencrypt/live/www.example.com/chain.pem -trust_other -timeout 10 -header Host=r3.o.lencr.org -url http://r3.o.lencr.org.
Error querying OCSP responder
139702347134784:error:02002071:system library:connect:No route to host:crypto/bio/bss_conn.c:189:hostname=r3.o.lencr.org service=80
139702347134784:error:2007306E:BIO routines:conn_state:nbio connect error:crypto/bio/bss_conn.c:193:
OCSP check failed for /etc/letsencrypt/live/www.example.com/cert.pem (are we offline?)
Running the command:
openssl ocsp -no_nonce -issuer /etc/letsencrypt/live/www.example.com/chain.pem -cert /etc/letsencrypt/live/www.example.com/cert.pem -CAfile /etc/letsencrypt/live/www.example.com/chain.pem -verify_other /etc/letsencrypt/live/www.example.com/chain.pem -trust_other -timeout 10 -header Host=r3.o.lencr.org -url http://r3.o.lencr.org.
by hand yields the same error, but it I remove the '-timeout 10' the command works fine. I am running openssl version 1.1.1g FIPS 21 Apr 2020. If I remove the timeout from the call in ocsp.py then 'certbot certificates -vvv' . I am confused why specifying a timeout in the openssl command line would cause a no route to host problem. Is this a bug in openssl or certbot? certbot can work around this by eliminating the timeout from the call.