We're seeing application issues (Veeam) due to revocation checks failing on our LE SSL certificates. It appears to maybe relate to [ r3.o.lencr.org ] being down at present? Maybe the incorrect SSL certificate on that site? Anyone else aware of this, any ETA or knowledge by Lets Encrypt of this issue…

Hi @MShar9e [image] MShar9e: We're seeing application issues (Veeam) due to revocation checks failing on our LE SSL certificates. It appears to maybe relate to [ r3.o.lencr.org ] being down at present? that's a known Ssllabs bug. Completely independend from your domain / configuration. See …

Yeah, ssllabs can't seem to connect to it for quite some time (I think I've seen reports on this forum for weeks about it), though I don't know if it's because one end or the other is blocking it. I don't see any problems checking OCSP through crt.sh. You probably need to be clearer about what act…

This isn't a bug in SSL Labs. Akamai is legit presenting a bad cert for r4.o.lencr.org which is resulting in global SSL certificate errors. Does anyone know if Let's Encrypt is engaging with Akamai to fix it?

The OCSP info embedded into certificates is a http: link, not https:, so I don't see how Akamai could be serving a certificate for it? And R4 hasn't issued any certificates ever, so why are you looking at the R4 OCSP? I don't see any issues from my side connecting to http://r3.o.lencr.org. Again, ca…

[image] csatola-od: This isn't a bug in SSL Labs. Please read the next reply - OCSP Error when testing new website - #3 by rg305 Some minutes later - it had worked. So it's a temporary Ssllabs problem - sometimes visible (with different OCSP domains), sometimes invisible.

[image.png] This is the application error and the URL originally mentioned listed on the certificate.... Seems to be getting traction with other people on Twitter as an active issue.

We have a few applications which enforce OCSP validation with Java 1.8.0, and these are currently failing with: Caused by: javax.net.ssl.SSLHandshakeException: PKIX path validation failed: java.security.cert.CertPathValidatorException: Certificate does not specify OCSP responder No changes on our …

Well,when I try from my computer I don't see a problem… $ curl -O https://letsencrypt.org/certs/lets-encrypt-r3.pem $ curl -O https://letsencrypt.org/certs/isrgrootx1.pem $ curl -o cert.pem https://crt.sh/?d=4316789025 $ openssl11 ocsp -no_nonce -url http://r3.o.lencr.org -header Host=r3.o.lencr.or…

Agreed, I couldn't see any issues with curl either. I can't pinpoint the root cause as such; other than tell the symptoms (Java isn't very forthcoming with details). All of the affected applications in our case are JRE 1.8.0; specifically: openjdk version "1.8.0_292" OpenJDK Runtime Environment (…

It appears (from other people's reporting about the error you've seen, but in another context) that OpenJDK can emit this error (a java.security.cert.CertPathValidatorException: Certificate does not specify OCSP responder) when it's not actually the cause at all. The text of that error suggests it …

Revocation Issues with CRL for R3 (was: r3.o.lencr.org)

Help

JuergenAuer April 30, 2021, 9:49pm 2

Hi @MShar9e

that's a known Ssllabs bug. Completely independend from your domain / configuration.

See

same with a GoDaddy OCSP check.

Topic		Replies	Views
OCSP server sending expired responses + stapling breaks Chrome Help	56	23367	December 18, 2016
All letsencrypt certificate show revocation erro information Help	26	3890	April 21, 2020
Certificate Revocation Lookup Failure Oct 19 2021 Help	10	1138	October 20, 2021
Windows Live Mail revocation warning Issuance Tech	29	12001	March 14, 2017
Validation error Help	9	4311	May 19, 2017

Revocation Issues with CRL for R3 (was: r3.o.lencr.org)

Related topics