4

Lately I've been continuously experiencing malfunctions of the site when browsing with HTTPS. The urls

only load sparsely, and otherwise fail to load with the following (browser) error:

Sichere Verbindung: Schwerer Fehler (1066)

https://cdn.sstatic.net/stackoverflow/all.css?v=a111fa6a843b

Die Identität der Website konnte nicht überprüft werden (OCSP-Fehler).

Die Antwort des Online-Servers zur Überprüfung des Zertifikats (OCSP) war zu alt.

(in English):

Secure connection: severe error (1066)

The identity of the website could not be verified (OCSP-Error).

The answer of the online-server for certificate verification (OCSP) was too old

When refreshing, after some time (maybe 10 minutes) it works again. Has someone experienced similar problems lately? If not, I might need to investigate in my connection or my browser settings.

8
  • 1
    HTTPS isn't supported...
    – Braiam
    Commented Sep 21, 2014 at 18:21
  • @Braiam: Sure, (and fallback HTTP works), but bugs should be reported nonetheless
    – Bergi
    Commented Sep 21, 2014 at 18:23
  • @Bergi - No they shouldn't. If HTTPS was officially supported then this would be a bug. Until then it's just telling the team something they probably already know.
    – ChrisF Mod
    Commented Sep 21, 2014 at 18:24
  • @ChrisF: That's not what the ssl tag description says… I know I can't expect them to fix it, but I still would like to know whether they already know of this problem, or whether there's even a known solution. If you don't like this to be tagged bug, feel free to fix it.
    – Bergi
    Commented Sep 21, 2014 at 18:27
  • @Bergi - Well that's me told.
    – ChrisF Mod
    Commented Sep 21, 2014 at 18:28
  • 1
    Cross site possbile duplicate: meta.stackexchange.com/questions/187469/…
    – rene
    Commented Sep 21, 2014 at 19:11
  • @rene: Thank you. As always, I forgot to search MSE before asking the question :-/
    – Bergi
    Commented Sep 21, 2014 at 19:15
  • I think this is related as well: meta.stackoverflow.com/questions/268249/…
    – rene
    Commented Sep 21, 2014 at 19:28

1 Answer 1

2

The site is using OCSP stapling, which means that the HTTPS server will retrieve the OCSP response (that is if the certificate was revoked or not) from the OCSP server by itself and attach it to the SSL handshake. This way the client does not need to do an extra OCSP request by itself to the OCSP server to check the revocation information.

But, each OCSP response has a recommended life time which lots of implementations treat as an hard expiration time. This means, that the server must refresh the OCSP response by getting a new OCSP response from the OCSP server, before the cached response expires. If this fails or if the OCSP server itself returns an expired certificate you get the error you see in the browser.

So this problem has usually nothing to do with browser settings. It is caused by failure of the HTTPS server to refresh the OCSP response or by failures of the OCSP server to return a non-expired response. The problem can also happen if the the servers behave correctly but the clock on your system is significantly wrong, so that it treats OCSP responses as expired which are still valid according to the real time. But this is not the case here, I get these "OCSP_check_validity:status expired" when checking with a test program.

5
  • Yes the HTTP server must get the OCSP response from the OCSP server so that it can attach it to the SSL handshake. This is called OCSP stapling. If no stapling is done the browser itself must get the OCSP response from the OCSP server. Commented Sep 21, 2014 at 18:59
  • Ok, i change it to HTTPS to make it more clear. Commented Sep 21, 2014 at 19:00
  • Thank you very much for the explanation (+1). So if this is the server's fault, shouldn't more users experience this problem?
    – Bergi
    Commented Sep 21, 2014 at 19:01
  • 1
    As far as I know stackoverflow is not officially on https, so only users which explicitly use it on https might see this errors. Also, most browsers will ignore OCSP soft errors (like this) or they don't use OCSP at all to check revocations. Commented Sep 21, 2014 at 19:10
  • Yeah, I see. And apparently some users already did - @rene found a duplicate question on MSE
    – Bergi
    Commented Sep 21, 2014 at 19:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .