SSL_CERT CRITICAL xxxx.xxxx.xx.xx:443: OCSP error (Responder Error: trylater (3))

[q2uantum]

We have been using this Nagios check for a few years now with no issues and find it really helpful to keep track of our certificate renewals.

Today a couple of our Nagios boards have been reporting this:

SSL_CERT CRITICAL xxxxx.xxxxx.xx.xx:443: OCSP error (Responder Error: trylater (3))

For all our certificates.

Do you have any idea on what could be causing this?

Running the following on the Nagios boxes in questions:

echo | openssl s_client -connect xxxxx.xxxxx.xx.xx:443 -status seems to report back all is ok

Reports back all is OK.

[q2uantum]

Just worked out how to clear it - apparently OCSP is being phased out by August this year.

We added --ignore-ocsp on to the command and Nagios has now cleared and we get an OK response back.

[matteocorti]

Hi, OCSP is slowing disappearing, but if a certificate contains an OCSP link, it should be possible to check it. Anyway --ignore-oscp should solve the problem in the next months.