SEC_ERROR_OCSP_OLD_RESPONSE

• OCSP response carries thisUpdate + nextUpdate timestamps (usually 7 days)
• nginx: ssl_stapling on + ssl_stapling_verify on + resolver 1.1.1.1 valid=300s
• Check: echo | openssl s_client -connect host:443 -status 2>/dev/null | grep -A10 "OCSP response"
• Must-Staple extension requires stapling — without it the browser refuses the connection
• Firefox re-checks every 24 h if the response is becoming stale

# Verify OCSP stapling works
$ echo | openssl s_client -connect host:443 -status 2>/dev/null | \
    grep -E "OCSP response|thisUpdate|nextUpdate"

# nginx config
ssl_stapling on;
ssl_stapling_verify on;
resolver 1.1.1.1 1.0.0.1 valid=300s;
resolver_timeout 5s;

# Force refresh OCSP cache — restart
$ systemctl reload nginx

• Setup OCSP stapling
• Must-Staple missing

The SEC_ERROR_OCSP_OLD_RESPONSE error in Firefox indicates that the browser has received an outdated response from the Online Certificate Status Protocol (OCSP) server when checking the revocation status of a digital certificate. To resolve this, ensure that your server is configured to send updated OCSP responses, or adjust the OCSP settings in Firefox to bypass this check temporarily while troubleshooting.

The SEC_ERROR_OCSP_OLD_RESPONSE error primarily arises due to outdated or misconfigured OCSP responses from the certificate authority (CA) or the server hosting the certificate. This issue can occur in various scenarios:

• Expired OCSP Responses: OCSP responses have a validity period, typically defined by the CA. If a response is older than its validity period, Firefox will reject it.
• Misconfigured Web Server: If the web server is not properly configured to fetch and serve the latest OCSP responses, users may encounter this error.
• Certificate Authority Issues: If the CA has not updated their OCSP response or if there are issues with their OCSP server, browsers may receive outdated information.
• Browser Cache: Sometimes, the browser may cache old OCSP responses, leading to repeated errors even after the server has been corrected.

To address these root causes, it is essential to regularly monitor and maintain your certificate configurations, ensuring that all OCSP responses are current and accessible.

To resolve the SEC_ERROR_OCSP_OLD_RESPONSE error, follow these practical steps:

1. Check OCSP Response Validity: Use the openssl command to check the validity of your OCSP response. Run the following command:

openssl ocsp -issuer  -cert  -url  -text

This command will provide details about the OCSP response, including its freshness. Ensure that the response is not expired.

1. Update Web Server Configuration: If you find that your OCSP responses are outdated, update your web server configuration to fetch the latest OCSP responses. In Apache, for example, you can add the following directive to your configuration:

SSLUseStapling On
SSLStaplingResponder http://ocsp.example.com
SSLStaplingCache "shmcb:/var/run/ocsp-stapling-cache(128000)"

This ensures that your server uses OCSP stapling, which reduces the need for clients to contact the OCSP server directly.

1. Clear Browser Cache: If changes have been made but the error persists, clear the Firefox cache to remove any stale OCSP responses. Go to Options > Privacy & Security > Cookies and Site Data and click on Clear Data.

1. Disable OCSP Checking (Temporary Solution): As a last resort, you can disable OCSP checking in Firefox while troubleshooting. Type about:config in the address bar, search for security.OCSP.enabled, and set it to 0. This is not recommended for long-term use, as it compromises security.

By following these steps, you should be able to effectively troubleshoot and resolve the SEC_ERROR_OCSP_OLD_RESPONSE error in Firefox, ensuring a smoother browsing experience for users accessing your web infrastructure.