# OCSP malformedrequest with 1.9.7 and openssl 1.0.2e **URL:** \ **Category:** NGINX\ **Created:** [December 4, 2015, 11:40pm UTC](https://www.ruby-forum.com/t/ocsp-malformedrequest-with-1-9-7-and-openssl-1-0-2e/243566 "2015-12-04T23:40:16Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Sadaf\_N](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/858c86/32.png) [@Sadaf\_N](https://www.ruby-forum.com/u/Sadaf_N)\ **Post date:** [December 4, 2015, 11:40pm UTC](https://www.ruby-forum.com/t/ocsp-malformedrequest-with-1-9-7-and-openssl-1-0-2e/243566/1 "2015-12-04T23:40:16Z")
Hello, OCSP is not working on my raspberrypi2 with nginx 1.9.7 and OpenSSL 1.0.2e. I have compiled both together. tail /var/log/nginx/error.log 2015/12/04 22:28:21 [error] 14841#0: OCSP response not successful (1: malformedrequest) while requesting certificate status, responder: [ocsp.startssl.com](http://ocsp.startssl.com) 2015/12/04 22:28:29 [error] 14841#0: OCSP response not successful (1: malformedrequest) while requesting certificate status, responder: [ocsp.startssl.com](http://ocsp.startssl.com) 2015/12/04 22:28:30 [error] 14842#0: OCSP response not successful (1: malformedrequest) while requesting certificate status, responder: [ocsp.startssl.com](http://ocsp.startssl.com) Got the ca-bundle.pem from [https://www.startssl.com/certs/?C=S;O=D](https://www.startssl.com/certs/?C=S;O=D) /etc/nginx/sites-enabled $ cat default … # OCSP Stapling ssl\_stapling on; ssl\_stapling\_verify on; ssl\_trusted\_certificate /etc/nginx/my\_ssl\_certs/ca-bundle.pem; resolver 8.8.8.8 8.8.4.4 valid=300s; resolver\_timeout 5s; … OCSP is not working after checks with sslabs and openssl e.g. echo QUIT | openssl s\_client -connect [www.mydomain.com:443](http://www.mydomain.com:443) -status 2\> /dev/null | grep -A 17 ‘OCSP response:’ | grep -B 17 ‘Next Update’ According to [https://www.ietf.org/rfc/rfc2560.txt](https://www.ietf.org/rfc/rfc2560.txt) the errors says: … OCSPResponseStatus ::= ENUMERATED { malformedRequest (1), --Illegal confirmation request … My StartSSL certificates are SHA2 ([https://www.startssl.com/certs/class1/sha2/pem/](https://www.startssl.com/certs/class1/sha2/pem/)) In /etc/nginx/sites-enabled/ I have more than one config / domain configured. But it does not matter wether I only configure OCSP in every single file or just default. I only found a Bug message here: " OpenSSL OCSP Bad Request" ([OpenSSL OCSP Bad Request](http://jfcarter.net/~jimc/documents/bugfix/21-openssl-ocsp.html)) saying you have to add: -header “HOST” “[ocsp.startssl.com](http://ocsp.startssl.com)” My options for compiling openssl & nginx have been ./config --prefix=$STATICLIBSSL no-ssl2 no-ssl3 no-shared && make depend && make && make install\_sw ./configure --with-cc-opt=“-I $STATICLIBSSL/include -I/usr/include” –with-ld-opt=“-L $STATICLIBSSL/lib -Wl,-rpath -lssl -lcrypto -ldl -lz” –sbin-path=/usr/sbin/nginx –conf-path=/etc/nginx/nginx.conf –pid-path=/var/run/nginx.pid –error-log-path=/var/log/nginx/error.log –http-log-path=/var/log/nginx/access.log –with-pcre=$BPATH/$VERSION\_PCRE –with-http\_ssl\_module –with-http\_v2\_module –with-file-aio –with-ipv6 –with-http\_gzip\_static\_module –with-http\_stub\_status\_module –without-mail\_pop3\_module –without-mail\_smtp\_module –without-mail\_imap\_module && make && make install Any ideas ? Thanks in advance, Alexander Posted at Nginx Forum: > **[OCSP malformedrequest with 1.9.7 and openssl 1.0.2e](https://forum.nginx.org/read.php?2,263279,263279#msg-263279)** > > Hello, OCSP is not working on my raspberrypi2 with nginx 1.9.7 and OpenSSL 1.0.2e. I have compiled both together. tail /var/log/nginx/error.log 2015/12/04 22:28:21 \[error\] 14841#0: OCSP response not successful (1: malformedrequest) while requesting... ---
**Author:** ![agruener](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/7ba0ec/32.png) [@agruener](https://www.ruby-forum.com/u/agruener)\ **Post date:** [December 5, 2015, 4:33am UTC](https://www.ruby-forum.com/t/ocsp-malformedrequest-with-1-9-7-and-openssl-1-0-2e/243566/2 "2015-12-05T04:33:32Z")
Hello! On Fri, Dec 04, 2015 at 05:40:02PM -0500, agruener wrote: > [ocsp.startssl.com](http://ocsp.startssl.com) > 2015/12/04 22:28:30 [error] 14842#0: OCSP response not successful (1: > malformedrequest) while requesting certificate status, responder: > [ocsp.startssl.com](http://ocsp.startssl.com) The message means that an OCSP request was successfully sent, but OCSP responder returned an error. This may be either due to OCSP response being indeed incorrect for some reason, or due to a problem on OCSP responder side. You may try the following: - check if OCSP requests from other clients (e.g., browsers) work; note that openssl’s OCSP client will likely fail out of the box; - check if the same error occurs on x86 hosts for the same certificate or not; - try tcpdump’ing traffic between nginx and the OCSP responder to see what happens on the wire. – Maxim D. > **[nginx](http://nginx.org/)** ---
**Author:** ![agruener](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/7ba0ec/32.png) [@agruener](https://www.ruby-forum.com/u/agruener)\ **Post date:** [December 5, 2015, 10:21am UTC](https://www.ruby-forum.com/t/ocsp-malformedrequest-with-1-9-7-and-openssl-1-0-2e/243566/3 "2015-12-05T10:21:06Z")
Dear Maxim, thanks for your ideas. I think I have not fully understand this matter, yet 😉 - check if OCSP requests from other clients (e.g., browsers) work; note that openssl’s OCSP client will likely fail out of the box; —\> it does not work with openssl on Ubuntu 14.04 LTS (OpenSSL 1.0.1f 6 Jan 2014), openssl on raspberrypi2 (OpenSSL 1.0.2e) and Qualsys ssllabs ([SSL Server Test (Powered by Qualys SSL Labs)](https://www.ssllabs.com/ssltest/)). I do not get any errors on the other hand in Firefox or Chrome on Windows / Ubuntu / Android browsing to my websites. But I do not know how to do the same OCSP tests with my browsers. - check if the same error occurs on x86 hosts for the same certificate or not; → I have to try this later, it is not that easy to set up here right now. - try tcpdump’ing traffic between nginx and the OCSP responder to see what happens on the wire. → I have done it. It is showing some communication when I do the test with openssl, e.g. echo QUIT | openssl s\_client -connect [www.mydomain.com:443](http://www.mydomain.com:443) -status 2\> /dev/null | grep -A 17 ‘OCSP response:’ | grep -B 17 ‘Next Update’ Pcap extraction show communication: … . StartCom Ltd.1+0)…U…"Secure Digital Certificate Signing1806…U…/StartCom Class 1 Primary Intermediate Server CA0… 151011024455Z… … . …M0…I0…g…0…;…+…7…0…_0…+…"[http://www.startssl.com/policy.pdf0](http://www.startssl.com/policy.pdf0)…+…0…0’. StartCom Certification Authority0…This certificate was issued according to the Class 1 Validation requirements of the StartCom CA policy, reliance only for the intended purpose in compliance of the relying party obligations.05…U…0,0_.(.&.$[http://crl.startssl.com/crt1-crl.crl0](http://crl.startssl.com/crt1-crl.crl0)…+…0.09…+…0…-[http://ocsp.startssl.com/sub/class1/server/ca0B](http://ocsp.startssl.com/sub/class1/server/ca0B)…+…0…6http://aia.startssl.com/certs/sub.class1.server.ca.crt0#…U…0…[Notice to all StartCom subscribers](http://www.startssl.com/0)… But at the end of my pcap I have a TLSv1.2 Record Layer: Encrypted Alert Content Type: Alert (21) Version: TLS 1.2 (0x0303) Length: 26 Alert Message: Encrypted Alert followed by FIN, ACK Greetings, Alexander Posted at Nginx Forum: > **[Re: OCSP malformedrequest with 1.9.7 and openssl 1.0.2e](https://forum.nginx.org/read.php?2,263279,263285#msg-263285)** > > Hello, OCSP is not working on my raspberrypi2 with nginx 1.9.7 and OpenSSL 1.0.2e. I have compiled both together. tail /var/log/nginx/error.log 2015/12/04 22:28:21 \[error\] 14841#0: OCSP response not successful (1: malformedrequest) while requesting... ---
**Author:** ![agruener](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/7ba0ec/32.png) [@agruener](https://www.ruby-forum.com/u/agruener)\ **Post date:** [December 7, 2015, 2:58am UTC](https://www.ruby-forum.com/t/ocsp-malformedrequest-with-1-9-7-and-openssl-1-0-2e/243566/4 "2015-12-07T02:58:15Z")
Hello! On Sat, Dec 05, 2015 at 04:20:32AM -0500, agruener wrote: > 2014), openssl on raspberrypi2 (OpenSSL 1.0.2e) and Qualsys ssllabs > ([SSL Server Test (Powered by Qualys SSL Labs)](https://www.ssllabs.com/ssltest/)). I do not get any errors on the other > hand in Firefox or Chrome on Windows / Ubuntu / Android browsing to my > websites. But I do not know how to do the same OCSP tests with my browsers. It looks like you’ve mistaken OCSP requests and OCSP stapling. You have to test OCSP requests from other clients, not if OCSP stapling is provided by your server. Note well that Browsers are not expected to show any errors if OCSP requests fail, and not all browsers will use OCSP by default or at all. You have to dump traffic between the browser and the OCSP responder to see what happens. […] > Pcap extraction show communication: > … > . > StartCom Ltd.1+0)..U…"Secure Digital Certificate > Signing1806..U…/StartCom Class 1 Primary Intermediate Server CA0.. > 151011024455Z… This seems to be traffic between openssl and nginx. You have to dump traffic between nginx and the OCSP responder ([ocsp.startssl.com](http://ocsp.startssl.com)) to see OCSP requests from nginx and responses with errors. – Maxim D. > **[nginx](http://nginx.org/)**