Ssl – OCSP server suggests trying again later

ocspssl

I am using Firefox to access my site secured with a free StartSSL certificate. I am sending an HSTS header (though now for testing I have it set to 15 seconds!) and I have enabled OCSP stapling.

Yesterday and this morning StartSSL's OCSP responder was down, and I was (not surprisingly) getting sec_error_ocsp_try_server_later whenever I tried to visit my site.

Now, however, StartSSL has fixed their OCSP responder as far as I can tell, and my site works fine on other local computers (running Windows) with Firefox, but still does not work on my personal computer (running Linux).

If anyone has any insight on this would be nice; I'm not even sure if the issue is in my Firefox, Linux, or some server setting wrong yet.

Oh, and I am using Apache web server on Linux to serve the site.
And I might as well give you the link.

Best Answer

I got the same message when viewing the site on Firefox.

It seems that the problem occurs when checking the revocation status of the StartSSL Intermediate certificate that was used to sign your certificate. It looks like their OCSP responder at ocsp.startssl.com still isn’t correctly responding to requests.

I used the online SSL server test from Qualys SSL Labs to test your server. When checking the revocation status of StartCom Class 1 Primary Intermediate Server CA, it reports that

OCSP ERROR: Request failed with HTTP status: 500 [http://ocsp.startssl.com/ca]

I also used the OpenSSL s_client diagnostic tool to check your server’s response:

echo | openssl.exe s_client -connect www.grepper.net:443 -CAfile /usr/ssl/certs/ca-bundle.crt -status

The -status option

sends a certificate status request to the server (OCSP stapling). The server response (if any) is printed out.

In your case, the response was:

OCSP response:
======================================
OCSP Response Data:
    OCSP Response Status: trylater (0x3)

BTW, congratulations on scoring the A in the SSL Labs test. It’s a shame that you configured everything correctly but were let down by external factors outside your control. I had been considering converting some personal sites to use HTTPS (and HSTS) with certificates from StartSSL but I wasn’t aware until now that there was such a critical reliance on the CA’s OCSP responder(s).

Related Topic