Unsuccessful OSCP response while requesting certificate status

I don't think the OCSP maintenance is related to this issue at all.

What I believe is happening is that you have orphaned nginx processes on your server.

Basically: some nginx workers are using an old version of your configuration, some are using a new version of your configuration. I'm not too sure how it happens, but very rarely it does.

How does this relate to SSL? It means some of the nginx workers are using your renewed certificate, and some are using the old certificate, which expired ~2 days ago. That lines up with this:

and it also lines up with the OCSP unauthorized response. Unauthorized is the response produced when an OCSP query is made for an expired certificate.

Why do I think you have orphaned nginx processes? Because when I connect to your server, I randomly see the wrong certificate.

$ openssl s_client -connect lymlyte.com:443 -showcerts 2>/dev/null | openssl x509 -noout -dates
notBefore=May  5 22:54:47 2020 GMT
notAfter=Aug  3 22:54:47 2020 GMT

$ openssl s_client -connect lymlyte.com:443 -showcerts 2>/dev/null | openssl x509 -noout -dates
notBefore=May  5 22:54:47 2020 GMT
notAfter=Aug  3 22:54:47 2020 GMT

$ openssl s_client -connect lymlyte.com:443 -showcerts 2>/dev/null | openssl x509 -noout -dates
notBefore=Mar  3 18:17:01 2020 GMT
notAfter=Jun  1 18:17:01 2020 GMT

$ openssl s_client -connect lymlyte.com:443 -showcerts 2>/dev/null | openssl x509 -noout -dates
notBefore=May  5 22:54:47 2020 GMT
notAfter=Aug  3 22:54:47 2020 GMT

Look at the dates on that second last connection.

To fix this: kill all your nginx processes. Make sure they are all really dead. Then restart nginx.

systemctl stop nginx
killall -9 nginx
ps aux | grep nginx
# Verify nothing came up in the grep, and then
systemctl start nginx

Besides orphaned nginx workers, the other possibility for how this could have occurred is if your nginx configuration has the same virtual host configured twice, and one of the configurations refers to an expired certificate.

But I think orphaned workers is more likely at this point.

2 Likes