Secure Connection Failed MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING

[Falna]

I get the above error when trying to access https://connect-racco.enedis.fr/ when using Pale Moon 32.4.1.

From looking online, it seems that this may be caused by some servers using SHA2 instead of SHA1.

It also seems that this was patched on Firefox a couple of years ago, so there may be a solution available - see https://bugzilla.mozilla.org/show_bug.cgi?id=1745600 - unless this is something that should be fixed server-side?

[Moonchild]

Well, the server-side configuration isn't very flexible, for sure, with how they only allow one cipher suite and one protocol that isn't the latest (only TLS 1.2), and it's a bit odd that they require SHA2 signatures for OCSP (that's overkill) while not using TLS 1.3, either.

I'll put this on my to-do list. We have a sufficiently recent NSS to be able to use this (it's a very recent addition to have this support) but it won't be implemented right away. I suggest if you have to use this and the server operators aren't willing to be a bit more flexible in their configuration, then you should use a different browser for their site for the time being while this is worked on.

By the way this deals with OCSP stapling, not OCSP lookups. You may be able to work around it as well by disabling OCSP stapled responses.
Set security.ssl.enable_ocsp_stapling to false to try this.
Once again that's a temporary workaround, not a solution.

[Moonchild]

Update: this will be solved in the new milestone.

[Falna]

Excellent - thanks