Let's Encrypt OCSP responders are showing 503 errors
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	Vgutierrez
	May 15 2020, 6:03 PM

Description

ocsp.int-x3.letsencrypt.org is currently returning 503s to acme-chief:

May 15 17:59:39 acmechief1001 acme-chief-backend[30417]: requests.exceptions.HTTPError: 503 Server Error: Service Unavailable for url: http://ocsp.int-x3.letsencrypt.org/
May 15 17:59:39 acmechief1001 acme-chief-backend[30417]: The above exception was the direct cause of the following exception:
May 15 17:59:39 acmechief1001 acme-chief-backend[30417]: Traceback (most recent call last):
May 15 17:59:39 acmechief1001 acme-chief-backend[30417]:   File "/usr/lib/python3/dist-packages/acme_chief/acme_chief.py", line 843, in _fetch_ocsp_response
May 15 17:59:39 acmechief1001 acme-chief-backend[30417]:     ocsp_response = ocsp_request.fetch_response()
May 15 17:59:39 acmechief1001 acme-chief-backend[30417]:   File "/usr/lib/python3/dist-packages/acme_chief/ocsp.py", line 73, in fetch_response
May 15 17:59:39 acmechief1001 acme-chief-backend[30417]:     raise OCSPRequestError from request_error
May 15 17:59:39 acmechief1001 acme-chief-backend[30417]: acme_chief.ocsp.OCSPRequestError

This is currently impacting the refresh of the OCSP response for the following certificates:

non-canonical-redirect-2

but it could potentially impact the unified cert for the 3 US DCs if the issue isn't solved in their side before May 19 08:00:00 2020 GMT

Event Timeline

Vgutierrez created this task.May 15 2020, 6:03 PM

Restricted Application added a project: SRE. · View Herald TranscriptMay 15 2020, 6:03 PM

Restricted Application added a subscriber: Aklapper. · View Herald Transcript

Vgutierrez triaged this task as Medium priority.May 15 2020, 6:03 PM

Vgutierrez moved this task from Backlog to TLS on the Traffic board.

May 15 19:43:27 acmechief1001 acme-chief-backend[30417]: Refreshing live OCSP response for certificate non-canonical-redirect-2 / ec-prime256v1
May 15 19:43:27 acmechief1001 acme-chief-backend[30417]: live OCSP response refreshed successfully for non-canonical-redirect-2 / ec-prime256v1
May 15 19:43:27 acmechief1001 acme-chief-backend[30417]: Refreshing live OCSP response for certificate non-canonical-redirect-2 / rsa-2048
May 15 19:43:27 acmechief1001 acme-chief-backend[30417]: live OCSP response refreshed successfully for non-canonical-redirect-2 / rsa-2048

It seems to be fixed on LE side by now :)

Let's Encrypt OCSP responders are showing 503 errorsClosed, ResolvedPublicActions

Description

Event Timeline

Let's Encrypt OCSP responders are showing 503 errors
Closed, ResolvedPublic
Actions