ssl - Nginx OCSP_basic_verify :signer certificate not found

Question

我在 Nginx 上设置 OCSP 装订并收到错误

OCSP_basic_verify() failed (SSL: error:27069076:OCSP routines:OCSP_basic_verify:signer certificate not found) while requesting certificate status, responder: ocsp.comodoca.com

这是nginx文件配置

server {
     ssl_certificate /etc/nginx/crtfile.crt;
     ssl_certificate_key /etc/nginx/keyfile.key;

     ssl_stapling on;
     ssl_stapling_verify on;
     ssl_trusted_certificate /etc/nginx/crttrusted.crt;
     resolver 8.8.8.8 8.8.4.4 valid=300s;
     resolver_timeout 15s;
}

请提出具体的解决方案。

Answer 1

您需要有一个 CNAME 才能实现。它应该是什么样子:

SPECIAL_KEY.your_domain.com CNAME SPECIAL_KEY.comodoca.com

直接从Comodo获取特殊 key 。

然后检查您的证书链，请注意按正确的顺序串联，查看详细信息here .