I'm working on OCSP stapling using this Go package: ocsp package - golang.org/x/crypto/ocsp - Go Packages Sometimes the response bytes from the OCSP server are: [48 3 10 1 6] or, in hex: []byte{0x30, 0x3, 0xa, 0x1, 0x6}. I see failures with both real certificates against the live OCSP endpoint and …

Lately I’ve been seeing this about half the time now, can’t be sure why: ocsp: error from server: unauthorized What does that mean?

i’m getting this error, too. not sure if it happens since beginnings but it seems to be related to ocsp stapling which i have enabled, too. ngrep output ######## T 78.46.100.157:58258 -> 195.138.255.49:80 [AP] POST / HTTP/1.0..Host: ocsp.int-x1.letsencrypt.org:80..Content-Type: application/ocsp-r…

Consider how many clients hammer this poor little API endpoint. It’s a wonder that the API answers at all, sometimes. And it will only get worse, not better. IMHO the only to deal with this (unsolvable?) problem is: Write a really tenacious OCSP client, with long retry pauses/timeouts, one that ign…

when the api is overloaded, why does it respond with unauthorized? it should respond with 2 or 3 then: https://www.rfc-editor.org/rfc/rfc2560.txt internalError (2), --Internal error in issuer tryLater (3), --Try again later “The response “unauthorized” is returned …

Thanks for reporting, @mholt ! We’ll take a look. This shouldn’t be happening, and almost certainly isn’t related to an overloaded endpoint.

I tried to reproduce using the examples you provided. I copied the Raw values from the two EE certs in your gist into a new Go file, and added logic to generate an OCSP request, fetch it, and parse the response. I get successes with both certificates. Do you reproduce the same behavior given the att…

I have also had this issue with OCSP unauthorized responses with my certificate on my home server using nginx approximately 5 hours ago. Gave it another crack just now and it is all working properly again

I have just had this on three of my four domains, which fetch the response “offline” via a cron job either every hour or every four hours, replacing the old file if successful (with “good” in the response). Until this batch of failures, it’s been running perfectly for five weeks. domain 1 (hourly)…

@dugite-code and @Troon : I believe the issues you ran into recently were caused by a brief misconfiguration this afternoon, now fixed. @mholt : One possible cause of your issue: Right now, Boulder may take up to a second to sign the first OCSP response after signing a certificate. [Edit Dec 2019: Bo…

Indeed, I get “good response” from both certificates, even after running it a hundred times. You’re making a GET, I’m making a POST, but both are according to spec. Will keep looking into this…

[Solved] OCSP server sometimes has malformed response of 5 bytes or "unauthorized"

Server

Topic		Replies	Views
Responder Error: unauthorized (6) Help	12	8339	December 20, 2019
OCSP server returns unauthorized status Issuance Tech	6	5860	November 2, 2016
Unauthorized trying to fetch OCSP response Help	18	2834	July 6, 2018
Successfully generated OCSP staples reporting unauthorized (6) Help	13	2232	February 16, 2021
Still seeing intermittent OCSP errors Help	6	2492	August 24, 2018

[Solved] OCSP server sometimes has malformed response of 5 bytes or "unauthorized"

Related topics