1

I'm trying to enable OCSP Stapling is Nginx. However when I test my SSL certificate, I'm running in to some issues.

Any ideas how to fix the 'OCSP response: no response sent' and 'verify error:num=20:unable to get local issuer certificate' issues?

I've masked some of the information as I'm not sure what is "safe" to post.

localhost# openssl s_client -connect www.example.com:443 -tls1 -tlsextdebug -status -CApath /etc/ssl/cert/RapidSSL_CA_bundle.pem

OCSP response: no response sent
depth=1 C = US, O = "GeoTrust, Inc.", CN = RapidSSL CA
verify error:num=20:unable to get local issuer certificate
verify return:0
---
Certificate chain
0 s:/serialNumber=3-XXXXXXX/XXXXXXX/SYLel9-A/OU=XXXXXXXX/OU=See www.rapidssl.com/resources/cps (c)14/OU=Domain Control Validated - RapidSSL(R)/CN=www.example.com
i:/C=US/O=GeoTrust, Inc./CN=RapidSSL CA
1 s:/C=US/O=GeoTrust, Inc./CN=RapidSSL CA
i:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA
---

...
...
Verify return code: 20 (unable to get local issuer certificate)

Edit: Nginx config

    # SSL Directives
    ssl_session_cache    shared:SSL:10m;
    ssl_session_timeout  10m;

    ssl_stapling on;
    ssl_stapling_verify on;
    ssl_trusted_certificate /etc/ssl/cert/RapidSSL_CA_bundle.pem;
    resolver 8.8.8.8 8.8.4.4 valid=300s;
    resolver_timeout 10s;

    ssl_prefer_server_ciphers On;
    ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS;
4
  • Post your nginx config, especially ssl related configs.
    – masegaloeh
    Oct 4, 2014 at 2:36
  • Done - edited my post with the SSL directives. Oct 4, 2014 at 2:38
  • What the content of /etc/ssl/cert/RapidSSL_CA_bundle.pem? This answer stated that you need provide Intermediate CA Bundle (RapidSSL SHA256 CA - G3) and Intermediate CA Bundle (GeoTrust Global CA)
    – masegaloeh
    Oct 4, 2014 at 2:53
  • 3
    Nginx requires that the certificate file contains the intermediate certificate appendend to the primary certificate. Oct 4, 2014 at 9:58

0

You must log in to answer this question.

Browse other questions tagged .