我在使用GlobalSign颁发的证书在nginx / 1.6.2上设置OCSP时遇到了麻烦。 我读了许多相关的post，但没有find我find的解决scheme。 当我连接到服务器时，OCSP不起作用
> openssl s_client -connect cawi.kondeor.at:443 -tls1 -tlsextdebug -status [...] . OCSP response: no response sent depth=2 C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA verify return:1 depth=1 C = BE, O = GlobalSign nv-sa, CN = GlobalSign Domain Validation CA - SHA256 - G2 verify return:1 depth=0 OU = Domain Control Validated, CN = cawi.kondeor.at verify return:1 --- Certificate chain 0 s:/OU=Domain Control Validated/CN=cawi.kondeor.at i:/C=BE/O=GlobalSign nv-sa/CN=GlobalSign Domain Validation CA - SHA256 - G2 1 s:/C=BE/O=GlobalSign nv-sa/CN=GlobalSign Domain Validation CA - SHA256 - G2 i:/C=BE/O=GlobalSign nv-sa/OU=Root CA/CN=GlobalSign Root CA --- Server certificate -----BEGIN CERTIFICATE----- [...] -----END CERTIFICATE----- subject=/OU=Domain Control Validated/CN=cawi.kondeor.at issuer=/C=BE/O=GlobalSign nv-sa/CN=GlobalSign Domain Validation CA - SHA256 - G2 --- No client certificate CA names sent --- SSL handshake has read 2944 bytes and written 372 bytes --- [...] --- 而nginx日志显示如下错误：
[error] 10646#0: OCSP_basic_verify() failed (SSL: error:27069065:OCSP routines:OCSP_basic_verify:certificate verify error:Verify error:unable to get issuer certificate) while requesting certificate status, responder: ocsp2.globalsign.com
我发现的所有其他post都与错误相关Verify error:unable to get LOCAL issuer certificate ，通过修复证书链解决。 我的证书链似乎没问题，因为openssl ocsp命令的工作原理（但只有当我使用由于CDN使用-header "HOST" "ocsp2.globalsign.com"参数）：
> openssl ocsp -issuer root_ca_and_intermediate.pem -cert signed_cert_and_intermediate.pem -url http://ocsp2.globalsign.com/gsdomainvalsha2g2 -CAfile root_ca_and_intermediate.pem -header "HOST" "ocsp2.globalsign.com" -resp_text OCSP Response Data: OCSP Response Status: successful (0x0) Response Type: Basic OCSP Response Version: 1 (0x0) Responder Id: 32B1CE1488C41C77C67D0B2DAEFE569D3A5F4E69 Produced At: Sep 12 20:46:48 2016 GMT Responses: Certificate ID: Hash Algorithm: sha1 Issuer Name Hash: D1F1B576F9EEC0C10F7AFC7C3124A9C3625D7C61 Issuer Key Hash: EA4E7CD4802DE5158186268C826DC098A4CF970F Serial Number: 1121CD2E68A5AE7FEF7A719EDD4AE4034F8B Cert Status: good [...] Certificate: Data: Version: 3 (0x2) Serial Number: 14:dd:f1:f0:75:30:57:18:61:ec:c0:2c Signature Algorithm: sha256WithRSAEncryption Issuer: C=BE, O=GlobalSign nv-sa, CN=GlobalSign Domain Validation CA - SHA256 - G2 Validity Not Before: Jul 25 03:28:41 2016 GMT Not After : Oct 25 03:28:41 2016 GMT Subject: C=BE, O=GlobalSign nv-sa/serialNumber=201607251137, CN=GlobalSign Domain Validation CA - SHA256 - G2 - OCSP Responder [...] -----BEGIN CERTIFICATE----- [...] -----END CERTIFICATE----- Response verify OK signed_cert_and_intermediate.pem: good This Update: Sep 12 20:46:48 2016 GMT Next Update: Sep 16 20:46:48 2016 GMT
我的nginxconfiguration的清理版本可以在这里find： http : //pastebin.com/KYujwSgS
Cloudflare可以成为这个问题，还是我忽略了一些东西？ 任何帮助是极大的赞赏！
感谢所有的评论！ 这让我再次仔细查看证书链，注意到我没有将根CA证书放入文件root_ca_and_intermediate.pem而是将中间证书放入了两次。
因此，现在的工作设置是：文件signed_cert_and_intermediate.pem包含站点的实际证书（第一个）和用于签署实际证书的中间证书（第二个）。 文件root_ca_and_intermediate.pem包含用于签署中间证书的中间证书（第一个）和根CA证书（第二个）。