Error querying OCSP responder

W1nterfl00d — Tue, 08 Feb 2022 09:28:18 GMT

We have an issue with the R3 root certificate caused by the OCSP Certificate Revocation Checking within our decryption profile. We're seeing all sites using this certificate being blocked due to unknown issuer. When we run the "debug sslmgr view ocsp all" we can see the responder URL as unavailable with error querying OCSP responder.

We've checked the OCSP and CRL traffic leaving our nodes and can see tcp-fins for all matching traffic.

We have a support case open for this but it's going nowhere, has anyone encountered a similar issue before / have any CLI commands to help our investigation?

Many thanks,

Ellis

Re: Error querying OCSP responder

kiwi — Thu, 10 Feb 2022 15:53:36 GMT

Hi @W1nterfl00d ,

Is there additional information in the sslmgr.log ?

If the S/N of a certificate is NOT listed in a CRL, which has IDP extension, the certificate status is marked as UNKNOWN.

Source: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CldJCAS

Hope this helps,

-Kiwi.

topic Re: Error querying OCSP responder in General Topics

Error querying OCSP responder

Re: Error querying OCSP responder