[Bug 237757] www/nginx-devel: OCSP stapling broken with security/libressl 2.9.1
bugzilla-noreply at freebsd.org
bugzilla-noreply at freebsd.org
Sun May 5 20:43:39 UTC 2019
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=237757
Bug ID: 237757
Summary: www/nginx-devel: OCSP stapling broken with
security/libressl 2.9.1
Product: Ports & Packages
Version: Latest
Hardware: Any
OS: Any
Status: New
Severity: Affects Many People
Priority: ---
Component: Individual Port(s)
Assignee: ports-bugs at FreeBSD.org
Reporter: freebsd at mnd.sc
CC: brnrd at freebsd.org, osa at FreeBSD.org
CC: brnrd at freebsd.org, osa at FreeBSD.org
LibreSSL has been updated to version 2.9.1, after the rebuild, nginx fails to
properly do OCSP stapling. OCSP stapling was working fine before, now I get an
error for each server section:
2019/05/05 22:38:07 [error] 199#101438: OCSP_basic_verify() failed (SSL:
error:27FFF076:OCSP routines:CRYPTO_internal:signer certificate not found)
while requesting certificate status, responder: ocsp.int-x3.letsencrypt.org,
peer: 2.21.242.245:80, certificate: "/www/vhosts/<domain>/.ssl/cert.pem"
Even though the configuration was working fine before, I've experimented with
adding all intermediate and root certificates to ssl_trusted_certificate,
without avail.
A similar question has been asked on ServerFault:
https://serverfault.com/questions/965324/why-am-i-unable-to-make-ocsp-stapling-work-with-my-nginx-libressl-on-freebsd-12?newreg=02a125f6203747b5bb564b489b16ec44
--
You are receiving this mail because:
You are the assignee for the bug.
More information about the freebsd-ports-bugs
mailing list