Let's encrypt OCSP support ended

[kapouer]

Before anyone bangs its head on the wall like I just did:
https://letsencrypt.org/2024/12/05/ending-ocsp/

[aniketh-crustdata]

I couldn't find any params to set stapling to false, any way to fix this?

[phil118]

What is suggested solution to this?

[reza-satya]

Will the ending of ocsp support cause auto renewing ssl certificate to stop working?

[kapouer]

Absolutely not. However, the PR above will remove useless code and avoid the warnings altogether.

[byrnedo]

I get more than warnings: I've had auto-ssl running continuously for about a year and a half, and now, along with the ocsp stapling issue, it can't seem to generate valid certificates.

The error that I see

9005510e7ca2 2025/06/10 20:32:48 [error] 36#36: *3 [lua] ssl_certificate.lua:260: set_response_cert(): auto-ssl: failed to set ocsp stapling for xxxxxxx - continuing anyway - failed to get ocsp response: failed to get OCSP responder: , context: ssl_certificate_by_lua*, client: 188.150.230.211, server: 0.0.0.0:443

Is my issue related?

Edit: This was a red herring for me, it's issuing fine, just warning

[reza-satya]

Yes, it's the same error I'm experiencing right now
It's because LE made all requests to OCSP fail

[byrnedo]

My issue was a red herring ( as in why it wasn't issuing correctly.)
I set OCSP_MUST_STAPLE="no" in my dehyrated config (/etc/dehydrated/config) but the warnings are still there.

[delphaber]

If disabling OCSP won't affect generation and renewal of certificates, what was its purpose in this repo then? 😅 Sorry for the noob question, I think I'm missing something :)

[kapouer]

If disabling OCSP won't affect generation and renewal of certificates, what was its purpose in this repo then? 😅 Sorry for the noob question, I think I'm missing something :)

The link in #302 (comment) explains it...

[kiuka]

any news on this? It would be nice if the OCSP stapling could be turned off