httpd-bugs mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From bugzi...@apache.org
Subject [Bug 61818] New: OCSP "SSLUseStapling on" completely blocking the server when something is off with the responder
Date Sun, 26 Nov 2017 12:57:08 GMT
https://bz.apache.org/bugzilla/show_bug.cgi?id=61818

            Bug ID: 61818
           Summary: OCSP "SSLUseStapling on" completely blocking the
                    server when something is off with the responder
           Product: Apache httpd-2
           Version: 2.4.29
          Hardware: PC
                OS: Mac OS X 10.1
            Status: NEW
          Severity: normal
          Priority: P2
         Component: mod_ssl
          Assignee: bugs@httpd.apache.org
          Reporter: raffaele.sandrini@origammi.co
  Target Milestone: ---

This will be a somewhat fuzzy issue because I don't have much data. Please
accept my apologies for that.

Today our production site went offline because it was impossible to connect to
it using TLS. The httpd error log just showed this error: 

AH01941: stapling_renew_response: responder error

without any supporting information. There was no indication that some name
could not be resolved or some IP not be reached.

The server is using the event MPM and pretty quickly all slots were in status
"R" and the server reported:

AH00484: server reached MaxRequestWorkers setting, consider raising the
MaxRequestWorkers setting
and
AH03490: scoreboard is full, not at MaxRequestWorkers.Increase ServerLimit.

Hence, the site was offline.

Our stapling configuration:

SSLUseStapling on
SSLStaplingResponderTimeout 5
SSLStaplingReturnResponderErrors off
SSLStaplingCache shmcb:/var/run/ocsp(128000)

I am not an export but from this configuration and the supporting documentation
I conclude that this situation should never have happened. Even with the OCSP
server not being available it should have just continued without "stapling" the
response.

Hence, this bug report.

Note 1: The certificate in question is issued by GoDaddy EV CA and I could
personally not confirm any issue with their OCSP service.

Note 2: At the same time vhosts using Let's Encrypt certificates still worked
with stapling enabled leading to the conclusion that there was something up
with GoDaddy. However as stated above, the error log did not indicate anything.

-- 
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org


Mime
View raw message