OCSP stapling refresh logging

[Jan Schaumann]

Hi,

I have an ATS instance that has OCSP stapling enabled. The logs
dutifully show:

[Apr 12 20:28:11.077] Server {0x2b0d22181700} NOTE: Success to refresh
OCSP response for 1 certificate.
[Apr 12 21:29:11.138] Server {0x2b0d22181700} NOTE: Success to refresh
OCSP response for 1 certificate.
[Apr 12 22:30:11.341] Server {0x2b0d22181700} NOTE: Success to refresh
OCSP response for 1 certificate.

However, since the server cannot talk to the internet outbound, it
cannot in fact refresh the OCSP status. This is as intended; however, I
wonder why the logs are claiming 'Success to refresh'.

I'd have expected an error message of some sort indicating the inability
to talk to the CA's OCSP URLs.

-Jan

[Leif Hedstrom]

Post by Jan Schaumann
Hi,
I have an ATS instance that has OCSP stapling enabled. The logs
[Apr 12 20:28:11.077] Server {0x2b0d22181700} NOTE: Success to refresh
OCSP response for 1 certificate.
[Apr 12 21:29:11.138] Server {0x2b0d22181700} NOTE: Success to refresh
OCSP response for 1 certificate.
[Apr 12 22:30:11.341] Server {0x2b0d22181700} NOTE: Success to refresh
OCSP response for 1 certificate.

Which version of ATS is this? Our resident expert on all things OCSP is Randall Meyer, hopefully he can help if you give him the version details:-).

Cheers,

— Leif

[Jan Schaumann]

Post by Leif Hedstrom
Which version of ATS is this?

This is 5.3.0; haven't tried/checked other versions.

-Jan

[Leif Hedstrom]

Post by Jan Schaumann

Post by Leif Hedstrom
Which version of ATS is this?

This is 5.3.0; haven't tried/checked other versions.

Ah so, 5.3.0 is not a supported version, and 6.2 is going to be EOLifed in a few months. A lot of things have changed since 5.x, including OCSP stuff (it now supports proxying the OCSP requests for example).

— Leif

[Jan Schaumann]

Post by Leif Hedstrom
Ah so, 5.3.0 is not a supported version, and 6.2 is going to be
EOLifed in a few months. A lot of things have changed since 5.x,
including OCSP stuff (it now supports proxying the OCSP requests for
example).

Fair enough. I'll see if using 7.x makes a difference.

Thanks!
-Jan