Introduction

OCSP revocation failures are confusing because the certificate itself may still be valid. The problem is that the client or server cannot obtain trustworthy revocation status from the certificate authority's responder. Some clients soft-fail and continue. Others warn or reject the connection depending on policy, stapling expectations, and responder behavior.

Symptoms

  • TLS scanners warn that revocation status could not be checked
  • Some clients connect while others fail or warn about OCSP problems
  • The server certificate chain looks valid, but stapling status is missing or stale
  • The issue starts after firewall, resolver, or certificate chain changes

Common Causes

  • The server cannot reach the OCSP responder over DNS or outbound HTTP
  • OCSP stapling is not enabled or cannot verify the issuer chain correctly
  • The served certificate chain is incomplete, so the server cannot fetch a valid OCSP response
  • A strict client requires revocation status while the environment relies on soft-fail behavior

Step-by-Step Fix

  1. 1.Check whether the live endpoint is stapling an OCSP response
  2. 2.This quickly tells you whether clients should be able to rely on the server or must contact the responder themselves.
bash
openssl s_client -connect example.com:443 -servername example.com -status
  1. 1.Verify outbound reachability to the responder and DNS resolution
  2. 2.If the server cannot resolve or reach the CA responder, stapling cannot refresh even with correct TLS config.
bash
curl -I http://r3.o.lencr.org
  1. 1.Enable or repair OCSP stapling with the correct issuer chain
  2. 2.Stapling usually depends on both a working resolver and a complete trusted chain on the server.
nginx
ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /etc/nginx/ssl/fullchain.pem;
resolver 1.1.1.1 1.0.0.1 valid=300s;
  1. 1.Retest after reload and compare client behavior
  2. 2.A successful fix should change both scanner results and the openssl -status output, not just one or the other.

Prevention

  • Keep issuer chain files complete and current on every TLS endpoint
  • Allow outbound access from web servers to CA OCSP responders where stapling is expected
  • Monitor live stapling status after certificate renewals
  • Document which clients in your environment soft-fail versus hard-fail on revocation checks