Date: Sun, 05 May 2019 20:43:32 +0000 From: bugzilla-noreply@freebsd.org To: ports-bugs@FreeBSD.org Subject: [Bug 237757] www/nginx-devel: OCSP stapling broken with security/libressl 2.9.1 Message-ID: <bug-237757-7788@https.bugs.freebsd.org/bugzilla/>
next in thread | raw e-mail | index | archive | help
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D237757 Bug ID: 237757 Summary: www/nginx-devel: OCSP stapling broken with security/libressl 2.9.1 Product: Ports & Packages Version: Latest Hardware: Any OS: Any Status: New Severity: Affects Many People Priority: --- Component: Individual Port(s) Assignee: ports-bugs@FreeBSD.org Reporter: freebsd@mnd.sc CC: brnrd@freebsd.org, osa@FreeBSD.org CC: brnrd@freebsd.org, osa@FreeBSD.org LibreSSL has been updated to version 2.9.1, after the rebuild, nginx fails = to properly do OCSP stapling. OCSP stapling was working fine before, now I get= an error for each server section: 2019/05/05 22:38:07 [error] 199#101438: OCSP_basic_verify() failed (SSL: error:27FFF076:OCSP routines:CRYPTO_internal:signer certificate not found) while requesting certificate status, responder: ocsp.int-x3.letsencrypt.org, peer: 2.21.242.245:80, certificate: "/www/vhosts/<domain>/.ssl/cert.pem" Even though the configuration was working fine before, I've experimented wi= th adding all intermediate and root certificates to ssl_trusted_certificate, without avail.=20 A similar question has been asked on ServerFault: https://serverfault.com/questions/965324/why-am-i-unable-to-make-ocsp-stapl= ing-work-with-my-nginx-libressl-on-freebsd-12?newreg=3D02a125f6203747b5bb56= 4b489b16ec44 --=20 You are receiving this mail because: You are the assignee for the bug.=
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-237757-7788>