Nginx“ssl_stapling”被忽略，主机在OCSP响应器中找不到“ocsp.comodoca.com”

Question

I'm trying to setup OCSP stapling on Nginx

I'm getting the error:

"ssl_stapling" ignored, host not found in OCSP responder "ocsp.comodoca.com"

Here's the file .conf

server {
    ssl_certificate /etc/nginx/myfile.crt;
    ssl_certificate_key /etc/nginx/myfile.key;

    ssl_stapling on;
    ssl_stapling_verify on;
    ssl_trusted_certificate /etc/nginx/myfile_trusted.crt;
    resolver 8.8.8.8 8.8.4.4 valid=300s;
    resolver_timeout 15s;
}

Please suggest a specific solution.

Answer 1

I've just met the same issue when testing a new nginx config with nginx -t ( run as root ); in my case the error message was:

2014/11/15 01:38:43 [warn] 5114#0: "ssl_stapling" ignored, host not found in OCSP responder "ocsp.startssl.com/sub/class1/server/ca"

However, I renewed my trial a second time a few seconds later and then it worked.

My advice are the following:

• check that the configured resolver is responding (but I believe you used Google Public DNS so they should be okay);
• try to remove the extraneous options (second resolver address, valid= parameter and resolver_timeout directive);
• check that your ssl_trusted_certificate file is a bundle of both root CA certificate and intermediate certificate in PEM format (in my case I appended the Class 1 Intermediate Server CA to the root CA with # cat ca.pem sub.class1.server.ca.pem > bundle_certs.pem ).

I just noticed your ssl_trusted_certificate file ends with .crt . I'm not sure whether this is really relevant but nginx documentation says (emphasis mine):

Syntax: ssl_trusted_certificate file ;
Default: —
Context: http, server

This directive appeared in version 1.3.7.

Specifies a file with trusted CA certificates in the PEM format used to verify client certificates and OCSP responses if ssl_stapling is enabled.

So you may want to check this first.

If it may help my OCSP config is:

# OCSP Stapling ---
# fetch OCSP records from URL in ssl_certificate and cache them
# see <http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_stapling>
ssl_stapling on;
resolver 192.168.1.254;
ssl_stapling_verify on;
# verify chain of trust of OCSP response using Root CA and Intermediate certs
ssl_trusted_certificate https/bundle_certs.pem;

Edit : 192.168.1.254 being my home router LAN IP. Each time I test nginx config I get the same error the first time, I guess the resolver has to be initialized or something in the like.