1151270 - sec_error_ocsp_unknown_cert OCSP failures due to issues with StartCom OCSP responders

Status: RESOLVED WORKSFORME

(Core :: Security: PSM, defect)

Description

[mdc]

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0 SeaMonkey/2.33.1
Build ID: 20150321194901

Steps to reproduce:

Visit https://mortonsolicitors.com/


Actual results:

OCSP error:
The OCSP server has no status for the certificate. (Error code: sec_error_ocsp_unknown_cert)


Expected results:

The website should load OK.  The server seems unhacked as far as I can tell, and IE and Chrome load the site OK.

Comment 1

[David Weir (satdav)]

Same issue on nightly

Comment 2

[:Cykesiopka]

In case it's relevant, https://www.ssllabs.com/ssltest/analyze.html?d=mortonsolicitors.com:
>                  www.mortonsolicitors.com
> 1 Sent by server Fingerprint: 8cbf983cacc120c3d233fdf241518a4f23d61e82
>                  RSA 2048 bits (e 65537) / SHA256withRSA
>                  OCSP ERROR: OCSP response: Certificate unknown
... which is a StartCom cert.

Comment 3

[Daniel Veditz [:dveditz]]

There's a known problem with StartCom's OCSP responder returning "Unknown" for newly-issued certs (see bug 1006479), but that shouldn't apply to a cert apparently issued four months ago. For a newly issued cert "unknown" probably means the cert issuing server hasn't updated the OCSP responder yet. For a months old cert it's an alarming response -- if you (the CA's OCSP responder) never heard of this cert is it fraudulent, stolen by a hacker? [Note, I'm not questioning your cert, I'm explaining the reasons some browsers consider "unknown" a bad response.] If the StartCom server is having temporary trouble it would be better if they returned "tryLater" responses. If they've truly lost track of having issued your cert that's alarming.

Comment 4

[Eddy Nigg (StartCom)]

Due to a technical issue the OCSP responders failed to update - they are syncing again and this issue should resolve itself within the next few hours for your if it haven't already. Make sure to restart your Firefox before trying again (since the unknown response is cached also).

Comment 5

[Eddy Nigg (StartCom)]

...for your site...

Comment 6

[:Cykesiopka]

Indeed, it looks like the OCSP responder issues have been resolved.