Enable OCSP stapling with Freeipa - Apache
1
vote
1
answer
854
views
I have 3 machines with Centos 7.
I have FreeIPA server installed on the first machine. This serves as a certificate authority in my network; it's my CA.
I have an other machine with FreeIPA client installed.
This one can provide web services for a third machine. It has a certificate generated by the CA.
The third machine doesn't have freeipa installed and makes https requests on the second machine.
I would like to use OCSP stapling.
So I have added the lines following in
/etc/httpd/conf.d/ssl.conf
of my 2d machine:
SSLUseStapling on
SSLStaplingCache shmcb:/run/httpd/sslcache(512000)
and restarted httpd.
When I make a https request from the third machine with curl it appears **OCSP no response send**.
So i think my CA (the Freeipa server on my first machine) is not well configured.
I tried to make changes in _nss.conf_ on the CA and I looked in
/etc/pki/pki-tomcat/ca/CS.cfg
but I don't succeed to enable ocsp stapling. I haven't any idea.
I add I have checked, in my IPA server, that _ca.ocsp=true_ in /var/lib/pki/pki-tomcat/ca/conf/CS.cfg
.
Can you help me please? I will be very grateful.
Thank you so much.
EDIT:
The certificate of the https server has an Authority info access extension with the ocsp responder's url and the url is correct.
The firewall is disabled.
ocsp -issuer ca.cert -cert server.cert -text -url http://ipa-ca.mydomain.com/ca/ocsp
gives an ocsp response but the command s_client -connect myserver.mydomain.com:443 -tls1 -tlsextdebug -status
gives **ocsp response: no response sent**.
I understand the ocsp responder is ok but the stapling doesn't work...
Asked by Beretta
(13 rep)
Oct 29, 2019, 05:05 PM
Last activity: Nov 4, 2019, 12:04 PM
Last activity: Nov 4, 2019, 12:04 PM