On Tue, May 28, 2019 at 08:43:33PM -0000, Khurrum Maqb via FreeIPA-users wrote:
I apologize for the successive emails.
FYI, the OCSP + the Server Cert error goes away and the CA starts responding after I turn
NSSOCSP off in /etc/httpd/conf.d/nss.conf
ah, iirc you mentioned earlier that the OCSP URI in the certificates
point to a non-existing responder. You should fix this by making sure
that requests to this address are somehow handled by the current OCSP
responder. But I think this should not break PKINIT since the Kerberos
libraries currently do not use OCSP.
bye,
Sumit
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
> Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.html
> List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...