Skip to content

Fail silently if there is no OCSP server #306

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Nov 11, 2025
Merged

Fail silently if there is no OCSP server #306

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 9 additions & 4 deletions lib/resty/auto-ssl/ssl_certificate.lua
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -159,7 +159,10 @@ end
local function get_ocsp_response(fullchain_der, auto_ssl_instance)
-- Pull the OCSP URL to hit out of the certificate chain.
local ocsp_url, ocsp_responder_err = ocsp.get_ocsp_responder_from_der_chain(fullchain_der)
if not ocsp_url then
if not ocsp_url and not ocsp_responder_err then
-- There is no OCSP responder, stop silently
return "", nil
elseif not ocsp_url then
return nil, "failed to get OCSP responder: " .. (ocsp_responder_err or "")
end

Expand Down Expand Up @@ -236,9 +239,11 @@ local function set_ocsp_stapling(domain, cert_der, auto_ssl_instance)
end

-- Set the OCSP stapling response.
local ok, ocsp_status_err = ocsp.set_ocsp_status_resp(ocsp_resp)
if not ok then
return false, "failed to set ocsp status resp: " .. (ocsp_status_err or "")
if ocsp_resp ~= "" then
local ok, ocsp_status_err = ocsp.set_ocsp_status_resp(ocsp_resp)
if not ok then
return false, "failed to set ocsp status resp: " .. (ocsp_status_err or "")
end
end

return true
Expand Down