Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

OCSP status unauthorized (with 1.7.0 and earlier) #345

Open
lkarsten opened this issue Jan 16, 2021 · 0 comments
Open

OCSP status unauthorized (with 1.7.0 and earlier) #345

lkarsten opened this issue Jan 16, 2021 · 0 comments
Assignees

Comments

@lkarsten
Copy link
Contributor

A server running hitch 1.7.0 is logging the following every 5 minutes:

Jan 16 10:39:43 hostname hitch[24465]: 20210116T103943.120223 [24494] {core} Error: OCSP response for cert /etc/letsencrypt/live/nnnn.no/hitch-bundle.pem has status unauthorized

What does it mean, and how do I fix this?

It appears for test domains that are possibly not being renewed. These are Let's Encrypt certificates. Is this hitch is trying to fetch an OCSP token/assurance for a certificate that has expired?

I have 300-400 of these in the log per day.

Can I somehow turn off OCSP stapling for some domains? I don't want to remove the test domains, even if they are expired currently. It is fine that they are, I just need to test varnish config changes by modifying my own /etc/hosts to point there temporarily. Going outside the TLS channel would void the test setup.

Any insight appreciated.

@daghf daghf self-assigned this Jan 18, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants