Skip to main content

cpanel / firefox /apache sec_error_ocsp_try_server_later

vicos
Just today starting receiving this error in Firefox when trying to connect to a site with SSL on one particular server: An error occurred during a connection to mysite.com. The OCSP server suggests trying again later. (Error code: sec_error_ocsp_try_server_later)
Found one recent post on the net which attributes this to an Apache 2.4 issue. I do not have this issue on another CPANEL server with LITESPEED or a third one with Apache 2.2. After digging deeper we concluded that the recent Apache upgrade from 2.2 to 2.4 has started creating the problem. Apparently the SSL Stapling support introduced in Apache 2.4 has issues. If you are having same issue then you can follow below given steps to safely disable the SSL Stapling on cPanel Servers : Edit /usr/local/apache/conf/includes/pre_virtualhost_global.conf The same file can also be modified from WHM - Apache Include Editor And insert : SSLUseStapling off Restart Apache to reload the changes : Service httpd restart
Can someone from CPANEL confirm this? I don't want to start mucking around w/o a definitive answer. My server has been running Apache 2.4 for some time and is not a recent upgrade from 2.2. I have WHM 11.50.0 (Build 30) on CentOS 6.7. I did do a reboot of the affected server on Saturday. So, I assume this either started with that or a recent cpupdate.

Comments

8 comments

Date Votes
  • cPanelMichael
    Hello :) The following third-party URL explains this issue in more detail:
    0
  • vicos
    Hello :) The following third-party URL explains this issue in more detail:
    0
  • cPanelKenneth
    Please open a support ticket so we can examine your server. That will help us pinpoint the error and resolve it. Thank you!
    0
  • PhoenixUK
    May i ask if this was resolved and if so, how? I'm experiencing exactly the same issue and its driving me stark raving mad. Thanks in advance.
    0
  • weetabix
    I also have the same issue. Goes away after restarting apache and comes back after a while. Cpanel ticket didn't really help a lot, about same info as I see in this thread. The analyst said "This is an issue with the SSL and the CA who issued the SSL. This is not related to cPanel or the services running on your server". I wish that I could shake the feeling that it's not with the CA.
    0
  • cPanelMichael
    It's possible the CA being served by the server is not matching during the OCSP step with the browser. You may want to check with the issuing authority of the certificate, to determine if updated CA Bundles are available. If they are, then re-installing the certificate on the domain may help alleviate this without having to resort to disabling the SSL Use Stapling function. You may also want to temporarily disable your server's firewall as one of the IP addresses for the CA might be getting blocked by the firewall. Thank you.
    0
  • weetabix
    There seem to be a problem with godaddys european ocsp server;
    0
  • cPanelMichael
    There seem to be a problem with godaddys european ocsp server;

    Internal case CPANEL-1851 is open to determine how to best handle this issue. There's currently no time frame on a decision, but I will update this thread with more information as it becomes available. Per the internal case: The following Apache settings appear to be a successful work-around to the issue with the OCSP responder:
    SSLStaplingReturnResponderErrors off SSLStaplingErrorCacheTimeout 60
    This has a two-fold effect of preventing OCSP responder failures being passed to the browser (the browser can then make an OCSP request on its own, if it chooses to), and the decreased error-cache timeout allows Apache to make another OCSP request to the server in a short enough period of time that it should succeed (in this unique situation), where it can then cache the successful result for an extended period of time.
    Thank you.
    0

Please sign in to leave a comment.

Didn't find what you were looking for?

New post