i run nginx/1.23.2 on linux

after a clear reboot, on first access to my site front page, I see in log

==> /var/log/nginx/example.com.443.error.log <==
2022/11/09 12:38:15 [info] 1460#1460: *2 SSL_do_handshake() failed (SSL: error:0A000412:SSL routines::sslv3 alert bad certificate:SSL alert number 42) while SSL handshaking, client: 2601:...:xxx1, server: [2600:...:xxx6]:443

if I immediately just reload the page in browser, no more problem; the page renders ok, SSL check out, all site nav is fine

subsequent hits to the front page are also OK

i use include letsencrypt certs.

digging around, i found this from 2013

Can't get OCSP stapling to work, despite openssl working fine
https://success.qualys.com/discussions/s/question/0D52L00004TnuFdSAJ/cant-get-ocsp-stapling-to-work-despite-openssl-working-fine

my config includes,

ssl_stapling on;
ssl_stapling_verify on;
ssl_stapling_responder http://r3.o.lencr.org/;
server {
ssl_trusted_certificate ...;
}

checking, after cold reboot, 1st connect returns an OCSP missing response

echo | openssl s_client -connect example.com:443 -servername example.com -tls1_3 -tlsextdebug -status
CONNECTED(00000003)
...
depth=0 CN = example.com
verify return:1
!! OCSP response: no response sent
...
---
SSL handshake has read 4384 bytes and written 318 bytes
Verification: OK
---
New, TLSv1.3, Cipher is TLS_CHACHA20_POLY1305_SHA256
Server public key is 384 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---
DONE

but an immediately subsequent 2nd try returns a response

echo | openssl s_client -connect example.com:443 -servername example.com -tls1_3 -tlsextdebug -status
CONNECTED(00000003)
...
verify return:1
OCSP response:
======================================
OCSP Response Data:
OCSP Response Status: successful (0x0)
Response Type: Basic OCSP Response
Version: 1 (0x0)
Responder Id: C = US, O = Let's Encrypt, CN = R3
Produced At: Nov 9 17:09:00 2022 GMT
Responses:
Certificate ID:
Hash Algorithm: sha1
Issuer Name Hash: 48D...3D1
Issuer Key Hash: 142...2BC
Serial Number: 022...84E
Cert Status: good
This Update: Nov 9 17:00:00 2022 GMT
Next Update: Nov 16 16:59:58 2022 GMT

Signature Algorithm: sha256WithRSAEncryption
Signature Value:
09:...:cf
======================================
...
---
SSL handshake has read 4894 bytes and written 318 bytes
Verification: OK
---
New, TLSv1.3, Cipher is TLS_CHACHA20_POLY1305_SHA256
Server public key is 384 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---
DONE


so far, this^^ is 100% reproducible for me; always/only on first load after boot

this 'feels' like a timeout before OCSP is cached, and no issues after.
not sure

reading up at

https://nginx.org/en/docs/http/ngx_http_ssl_module.html

i see

ssl_stapling_responder

"Overrides the URL of the OCSP responder specified in the “Authority Information Access” certificate extension."

which i use, but also

ssl_ocsp_responder

"Overrides the URL of the OCSP responder specified in the “Authority Information Access” certificate extension for validation of client certificates. "

which I don't currently.

what's the difference in function/usage between those two?

As far as caching, I also see

ssl_ocsp_cache

which i haven't defined, so it's at default

ssl_ocsp_cache off

any clues as to what's missing/misconfig'd and responsible for the 1st-time-only fails I see?

_______________________________________________
nginx mailing list -- nginx@nginx.org
To unsubscribe send an email to nginx-leave@nginx.org