Sample Header Ad - 728x90

Enable OCSP stapling with Freeipa - Apache

1 vote
1 answer
854 views
I have 3 machines with Centos 7. I have FreeIPA server installed on the first machine. This serves as a certificate authority in my network; it's my CA. I have an other machine with FreeIPA client installed. This one can provide web services for a third machine. It has a certificate generated by the CA. The third machine doesn't have freeipa installed and makes https requests on the second machine. I would like to use OCSP stapling. So I have added the lines following in
/etc/httpd/conf.d/ssl.conf
of my 2d machine: SSLUseStapling on SSLStaplingCache shmcb:/run/httpd/sslcache(512000) and restarted httpd. When I make a https request from the third machine with curl it appears **OCSP no response send**. So i think my CA (the Freeipa server on my first machine) is not well configured. I tried to make changes in _nss.conf_ on the CA and I looked in
/etc/pki/pki-tomcat/ca/CS.cfg
but I don't succeed to enable ocsp stapling. I haven't any idea. I add I have checked, in my IPA server, that _ca.ocsp=true_ in
/var/lib/pki/pki-tomcat/ca/conf/CS.cfg
. Can you help me please? I will be very grateful. Thank you so much. EDIT: The certificate of the https server has an Authority info access extension with the ocsp responder's url and the url is correct. The firewall is disabled.
ocsp -issuer ca.cert -cert server.cert -text -url http://ipa-ca.mydomain.com/ca/ocsp 
gives an ocsp response but the command
s_client -connect myserver.mydomain.com:443 -tls1  -tlsextdebug  -status
gives **ocsp response: no response sent**. I understand the ocsp responder is ok but the stapling doesn't work...
Asked by Beretta (13 rep)
Oct 29, 2019, 05:05 PM
Last activity: Nov 4, 2019, 12:04 PM