Hello!

On Tue, Sep 22, 2015 at 05:33:57AM -0400, 173279834462 wrote:

> Hello,
>
> nginx is not updating the OCSP response cache.
>
> openssl says:
> [...]
> Cert Status: good
> This Update: Sep 9 09:59:46 2015 GMT
> Next Update: Sep 11 09:59:46 2015 GMT
>
> gnutls says "There is a newer OCSP response but was not provided by the
> server".
>
> The configuration says:
>
> [...]
> ssl_stapling on;
> ssl_stapling_verify on;
> ssl_stapling_file [...]/ssl/ocsp-response.der;
> [...]
>
>
> How do you enforce automatic update of the OCSP response cache?

You are using ssl_stapling_file, that is, nginx will always return
content of the file specified and it's you who have to update the
file. Quoting docs (http://nginx.org/r/ssl_stapling_file):

: When set, the stapled OCSP response will be taken from the
: specified file instead of querying the OCSP responder specified in
: the server certificate.

If you want nginx to fetch OCSP responses for you instead, comment
out this directive.

--
Maxim Dounin
http://nginx.org/

_______________________________________________
nginx mailing list
nginx@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx