i run
nginx -v
nginx version: nginx/1.23.3 (Local Build)
nginx is launched on boot with a systemd service
my site's ssl enabled, using letsencrypt certs
in my boot logs, i see
Feb 15 11:54:03 svr017 nginx[912]: nginx: [warn] "ssl_stapling" ignored, host not found in
OCSP responder "r3.o.lencr.org/" in the certificate "/sec/svr017/fullchain.ec.crt.pem"
nginx site config includes
ssl_trusted_certificate "/sec/svr017/intermediate_ca.ec.crt.pem";
ssl_certificate "/sec/svr017/fullchain.ec.crt.pem";
ssl_certificate_key "/sec/svr017/priv.ec.key";
ssl_stapling on;
ssl_stapling_verify on;
ssl_ocsp on;
ssl_ocsp_cache shared:OCSP:10m;
ssl_stapling_responder http://r3.o.lencr.org/;
ssl_ocsp_responder http://r3.o.lencr.org/;
checking the cert
openssl x509 -noout -text -in /sec/svr017/fullchain.ec.crt.pem | grep
-i ocsp -A2 -B1
Authority Information Access:
OCSP - URI:http://r3.o.lencr.org
CA Issuers - URI:http://r3.i.lencr.org/
X509v3 Subject Alternative Name:
from the host
dig A r3.o.lencr.org +short
o.lencr.edgesuite.net.
a1887.dscq.akamai.net.
23.215.130.112
23.215.130.106
23.215.130.113
23.215.130.88
telnet -4 r3.o.lencr.org 80
Trying 23.63.77.32...
Connected to r3.o.lencr.org.
Escape character is '^]'.
curl -Ii http://r3.o.lencr.org/
HTTP/1.1 200 OK
Server: nginx
Content-Length: 0
Cache-Control: max-age=5863
Expires: Wed, 15 Feb 2023 18:52:39 GMT
Date: Wed, 15 Feb 2023 17:14:56 GMT
Connection: keep-alive
is this warning due to a nginx misconfig? or a cert issue?
_______________________________________________
nginx mailing list
nginx@nginx.org
https://mailman.nginx.org/mailman/listinfo/nginx
