Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

OLS doesn't renew OCSP respone with certbot #332

Open
aonsyed opened this issue Sep 7, 2022 · 0 comments
Open

OLS doesn't renew OCSP respone with certbot #332

aonsyed opened this issue Sep 7, 2022 · 0 comments

Comments

@aonsyed
Copy link

aonsyed commented Sep 7, 2022

Certbot uses symlinks to /etc/letsencrypt/archive/domain/ instead of replacing the file in /etc/letsencrypt/live/domain/, OLS doesn't check for the changes in the symlink and staples the OSCP response for the older cert along with the new cert, firefox throws a certificate error and blocks the connection

Steps to recreate.

Use certbot for SSL

Vist site ( it works normally)

Renew SSL

Restart OLS

Visit the site again in firefox ( it won't work )

Proposed solution:
As OLS checks for change to get a new cached OCSP response, it should also check if cert/key in vhost is a symlink and in case it is a link, check for the change in link and get a new response to staple

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant