12

Why trying to access one of my favorite sites that use HTTPS I've hit an error page about the OCSP server:

Secure Connection Failed

An error occurred during a connection to www.baka-tsuki.org. The OCSP server experienced an internal error. (Error code: sec_error_ocsp_server_error)

  • The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.
  • Please contact the website owners to inform them of this problem. Alternatively, use the command found in the help menu to report this broken site.

I've asked around and the site is fine and dandy, without problems. Why is this happening?

|improve this question
  • 1
    Not an answer to why it is happening, but clearing the cache fixed it for me. – user403038 Dec 30 '14 at 8:26
  • This happend to me on a CENTOS 6.7 x86_64 virtuozzo – server WHM 11.50.0 (build 30) web server when I renewed the SSL certificate. After contacting the SSL CA support they explained that the problem was caused by the web servers cache not updating fast enough. By refreshing the ocsp and crl cache manually it would solve the problem. Before I had time to do this the cache had updated and https access worked again in Firefox. So in some cases it could be a question of waiting a little. – Don King Sep 21 '15 at 17:23
5

Issue #1: sec_error_ocsp_server_error can occur for other reasons than OCSP server internal error.

From Bugzilla bug 495380:

SEC_ERROR_OCSP_SERVER_ERROR is used 5 times in ocsp.c for everything from an internal OCSP server error to failing create the request session and any number of different problems writing the request to the remote server.`

Issue #2: I believe that Firefox is caching this error but should not do so, so I created Bugzilla bug report 1014979.

Workarounds (from a post that I wrote at another forum):

Method #1: Restart Firefox.

Method #2: Go to Options->Advanced->Certificates-> Validation. Set checkbox "When an OCSP server connection fails, treat the certificate as invalid" to the opposite of what it is now, and then press OK button twice. That is sufficient to clear the OCSP cache. However, since you probably want the original setting that you just changed, go to Options->Advanced->Certificates-> Validation and set checkbox "When an OCSP server connection fails, treat the certificate as invalid" back to the value that was there before you read this post, then press OK button twice.

|improve this answer
  • 2
    I had problems with https @ microsoft.com and Firefox 38 (the checkbox mentioned doesn't exist). So I emptied the cache, reset a few about:config settings for "ocsp", disabled "enable_ocsp_stapling". Now working, so I reset stapling. In case this helps anyone. – Nigel Touch May 21 '15 at 10:29
  • @Nigel Touch: That checkbox was removed in a later version of Firefox. The equivalent about:config setting is security.OCSP.require. – MrBrian May 24 '15 at 1:43
  • @Nigel Touch: Thank you, toggling security.ssl.enable_ocsp_stapling to false makes the https:// work. But I wanted to comment that if I reset it, it stops working again. and MrBrian: The value security.OCSP.require was already set to false in the latest version of FF and did it did not work changing it to true. – Don King Sep 21 '15 at 15:49
3

When you were trying to connect to the page, your connection or the server was momentarily unavailable and you have set "When an OCSP connection fails, treat the certificated as invalid". Firefox cache this error for a while (5 minutes, more or less) where you can't connect to the server. The only solution is deactivating the option in your configuration and activating it again, reseting the counter.

If the server uses OCSP stapling, this shouldn't be a problem. Try contacting the server administrator and report the issue.

|improve this answer
  • 1
    This is horrible advice. Besides what feature are you telling the author to disable? OCSP shouldn't be disabled. – Ramhound May 25 '14 at 6:04
  • 4
    @Ramhound I'm not telling anyone to disable anything, just force cache clearing as MrBrian also points out. – Braiam May 25 '14 at 6:59
2

The OCSP connection, like standard HTTP connections, made by Firefox may be affected by addons, notably ad blockers.

To verify the issue, take the normal path of disabling the addons, and then once the addon is identified, leave it enabled and disable the ad blocking subscriptions, to narrow the cause. However, each test must be run after a clean restart of Firefox, as OCSP responses are cached including server failures, and there is no way to clear the OCSP cache.

If the failure is do to a broken ad blocker subscription, please then report the fact to the author.

I have personally experienced this issue, had it fixed, and verified the fix.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.