search

jxskiss / simplessl

On the fly SSL certificate issue and renewal inside OpenResty with Let's Encrypt
MIT License
45 stars 13 forks source link

[ERROR] ocsp manager: failed request OCSP stapling: key_name= autocert|domain.com, err= ocsp: error from server: unauthorized #3

Closed rtf6x closed 3 years ago

rtf6x commented 3 years ago

Such errors are flooding our logs (appearing every second).

jxskiss commented 3 years ago

Sorry about that, I will look at it soon later.

jxskiss commented 3 years ago

@rtf6x Hi, I have some questions, can you help to do a confirm?

  1. is the certificate auto issued from Let's Encrypt, or it is a managed certificate?
  2. if Let's Encrypt, is the logging messages appear right after the certificate been issued?
  3. did the messages stop after some time, if yes, how long did it take?
jxskiss commented 3 years ago

From my view, the error messages is caused by a newly issued certificate, whose OCSP stapling is not ready, then Let's Encrypt server will return an "unauthorized" error, then the Akamai cached that response. This cause the following requests all get the error response, the error message will automatically stop after some time. But to address the "flooding error" problem, I made a commit https://github.com/jxskiss/ssl-cert-server/commit/17bee0af1b4384e83a59ea95ca5cb9980c373473 to suppress error messages to log same error message at most once per minute.

@rtf6x You may try the fixed version, plz let me know if you have further questions.