nghttpx 启动报错，提示证书问题

V2EX = way to explore

V2EX 是一个关于分享和探索的地方

For Existing Member Sign In

This topic created in 3902 days ago, the information mentioned may be changed or developed.

启动 nghttpx 有报错："failed to extract ocsp URI from"

反复生成几次证书都是这个结果，求指点下

证书生成大致步骤：
1. openssl genrsa -out private/cakey.pem 2048
2. openssl req -new -x509 -key private/cakey.pem -out cacert.pem
3. openssl genrsa -out nginx.key 2048
4. openssl req -new -key nginx.key -out nginx.csr
5. openssl ca -in nginx.csr -out nginx.crt

然后用 nginx.key 和 nginx.crt 启动 nghttpx 就报错了……

3 replies • 2015-09-30 12:59:43 +08:00

yvy

Aug 27, 2015

官方文档 https://nghttp2.org/documentation/nghttpx.1.html

启动参数加上 --no-ocsp 试试，或者配置文件里加入 no-ocsp=yes

来源参考 https://wzyboy.im/post/1052.html

lj0014

Aug 27, 2015

@yellowvii 谢谢，确实可以了

gfgrgerg

Sep 30, 2015

30/Sep/2015:00:46:06 -0400 PID22224 [NOTICE] Listening on 0.0.0.0, port 443
30/Sep/2015:00:46:06 -0400 PID22224 [NOTICE] Worker process (22225) spawned
30/Sep/2015:00:46:06 -0400 PID22224 [NOTICE] Renew new ticket keys
fetch-ocsp-response (using OpenSSL 1.0.1f 6 Jan 2014)
failed to extract ocsp URI from /usr/local/etc/cakeyfiles/server.crt
30/Sep/2015:00:46:06 -0400 PID22224 [WARN] shrpx_connection_handler.cc:550 ocsp query command for /usr/local/etc/cakeyfiles/server.crt failed: error=0, rstatus=65280, status=255

o-ocsp=yes 怎么加，默认配置文件是 /etc/nghttpx/nghttpx.conf
我这个目录都没有，我是直接这样的
nghttpx \
--frontend=*,443 \
--backend=localhost,3128 \
怎么找到这个配置文件位置