OCSP error in SXG

[shigeki]

Description of the issue found on ampproject.org

Please provide:

• https://amp.dev/events/amp-conf-2019
• OCSP error in SXG verifying

How do we reproduce the issue?

Please provide the steps to reproduce the issue:

1. Step 1 to reproduce
   Access to AMPConf site of https://amp.dev/events/amp-conf-2019 via google search in mobile browser or simulated devtool and get SXG file.

2. Step 2 to reproduce
   Devtool shows OCSP error in SXG.

What browser are you using?
Chrome73
What O/S are you using?
Android, MacOS

OCSP in SXG was expired on April 17.

Certificate #0:
  Subject: amp.dev
  Valid from: 2019-04-03 00:00:00 +0000 UTC
  Valid until: 2021-04-07 12:00:00 +0000 UTC
  Issuer: DigiCert ECC Secure Server CA
  Embedded SCT:
    LogID: 7ku9t3XOYLrhQmkfq+GeZqMPfl+wctiDAMR7iXqo/cs=
    LogID: h3W/51l8+IxDmV+9827/Vo1HVjb/SrVgwbTq/16ggw8=
    LogID: RJRlLrDuzq/EQAfYqP4owNrmgr7YyzG1P9MzlrW2gag=
  Has canSignHttpExchangesDraft extension
OCSP response:
  Status: 0 (good)
  ProducedAt: 2019-04-10 15:08:48 +0000 UTC
  ThisUpdate: 2019-04-10 15:08:48 +0000 UTC
  NextUpdate: 2019-04-17 14:23:48 +0000 UTC
Certificate #1:
  Subject: DigiCert ECC Secure Server CA
  Valid from: 2013-03-08 12:00:00 +0000 UTC
  Valid until: 2023-03-08 12:00:00 +0000 UTC
  Issuer: DigiCert Global Root CA｀

[sebastianbenz]

Thanks for reporting. It was a problem with the OCSP cert being cache and not updated on time. We've deployed a fix, but it's going to take a while until the AMP Cache is going to pick it up.

[sebastianbenz]

Leaving this bug open until we properly identified the reason why the cache has not been updated.

[shigeki]

Thanks. I confirmed that the OCSP data was updated and waiting for its cache updates.

Certificate #0:
  Subject: amp.dev
  Valid from: 2019-04-03 00:00:00 +0000 UTC
  Valid until: 2021-04-07 12:00:00 +0000 UTC
  Issuer: DigiCert ECC Secure Server CA
  Embedded SCT:
    LogID: 7ku9t3XOYLrhQmkfq+GeZqMPfl+wctiDAMR7iXqo/cs=
    LogID: h3W/51l8+IxDmV+9827/Vo1HVjb/SrVgwbTq/16ggw8=
    LogID: RJRlLrDuzq/EQAfYqP4owNrmgr7YyzG1P9MzlrW2gag=
  Has canSignHttpExchangesDraft extension
OCSP response:
  Status: 0 (good)
  ProducedAt: 2019-04-17 15:08:55 +0000 UTC
  ThisUpdate: 2019-04-17 15:08:55 +0000 UTC
  NextUpdate: 2019-04-24 14:23:55 +0000 UTC
Certificate #1:
  Subject: DigiCert ECC Secure Server CA
  Valid from: 2013-03-08 12:00:00 +0000 UTC
  Valid until: 2023-03-08 12:00:00 +0000 UTC
  Issuer: DigiCert Global Root CA

[sebastianbenz]

Fixed by moving packager into an internal VM