OCSP errors with GoDaddy certs

[jfayne]

I have a very recent issue with checking certs from GoDaddy. They will occasionally return a bad status. Upon further digging the status is actually a 307 redirect. This happens only on GoDaddy certs, and does not happen every time. The behavior comes and goes.

My typical command line usage is
check_ssl_cert -w 45 -c 30 -A -H DOMAIN --ignore-ocsp-errors --debug

An excerpt from debug logs

[DBG] extracting cert attribute oscp_uri
[DBG] OCSP: URIs = http://ocsp.godaddy.com/
[DBG] OCSP: URI = http://ocsp.godaddy.com/
[DBG] OCSP: host = ocsp.godaddy.com
[DBG] openssl ocsp supports the -header option
[DBG] /omd/sites/awsmaster/bin/openssl ocsp -header requires 'key=value'
[DBG] executing /omd/sites/awsmaster/bin/openssl ocsp -timeout "119" -no_nonce -issuer /tmp/b3rW8P -cert /tmp/Ym6OdN -url http://ocsp.godaddy.com/ -header HOST=ocsp.godaddy.com
[DBG] OCSP: response = Error querying OCSP responder
[DBG] OCSP: response = 140190122288960:error:27076072:OCSP routines:parse_http_line1:server response error:crypto/ocsp/ocsp_ht.c:260:Code=307,Reason=Temporary Redirect
[DBG] OCSP: not good. HTTP_PROXY =
[DBG] executing /omd/sites/awsmaster/bin/openssl ocsp -timeout "119" -no_nonce -issuer "/tmp/b3rW8P" -cert "/tmp/Ym6OdN" -url "http://ocsp.godaddy.com/" "" 2>&1
[DBG] Response verify OK
[DBG] /tmp/Ym6OdN: good
[DBG] This Update: Mar 20 16:07:34 2024 GMT
[DBG] Next Update: Mar 24 16:06:34 2024 GMT

[matteocorti]

It seems that the OCSP server is not reachable. Which is the output of the plugin?

[jfayne]

I'm not sure I understand the question, howserver the OCSP server is available. It doesn't time out, or fail outright, it just throws a response like this "Code=307,Reason=Temporary Redirect" every so often. Since this is not a 200 level status it looks more like a failure. I haven't been able to find where the redirect is pointing yet.

I set up a loop to prevent the script from deleting the temp files for a single run. I then used the command as presented in the debug output to test the responses.

$PATH/openssl ocsp -timeout "119" -no_nonce -issuer "/tmp/b3rW8P" -cert "/tmp/Ym6OdN" -url "http://ocsp.godaddy.com/" "" 2>&1

I ran it approx 10 times and it returned the 307 status code maybe 3-4 times? The interesting thing is it didn't respond slowly, rather it was an almost immediate response with the redirect.

[matteocorti]

This means that the OCSP responder is temporarily delivering a redirect. As you specify --ignore-ocsp-errors the script should continue and return an OK status. But without the complete debugging output is difficult to say ...