# Dnf issue with OCSP check / TLS cert

**URL:** <https://forums.rockylinux.org/t/dnf-issue-with-ocsp-check-tls-cert/13691>\
**Category:** Rocky Linux Help & Support\
**Created:** [April 22, 2024, 7:01pm UTC](https://forums.rockylinux.org/t/dnf-issue-with-ocsp-check-tls-cert/13691 "2024-04-22T19:01:25Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ritov](https://avatars.discourse-cdn.com/v4/letter/r/3ec8ea/32.png) [@Ritov](https://forums.rockylinux.org/u/Ritov)\
**Post date:** [April 22, 2024, 7:01pm UTC](https://forums.rockylinux.org/t/dnf-issue-with-ocsp-check-tls-cert/13691/1 "2024-04-22T19:01:25Z")

</div>

It seems that the OCSP check does not work reliable? Anyone seeing this?

```auto
# LANG=C yum update --refresh
...
Rocky Linux 9 - BaseOS 0.0 B/s | 0 B 00:01    
Errors during downloading metadata for repository 'baseos':
  - Curl error (91): SSL server certificate status verification FAILED for https://mirrors.rockylinux.org/mirrorlist?arch=x86_64&repo=BaseOS-9 [No OCSP response received]
Error: Failed to download metadata for repo 'baseos': Cannot prepare internal mirrorlist: Curl error (91): SSL server certificate status verification FAILED for https://mirrors.rockylinux.org/mirrorlist?arch=x86_64&repo=BaseOS-9 [No OCSP response received]

```

An Let’s Encrypt infra issue?

---

<div class="post-metadata">

**Author:** ![Ritov](https://avatars.discourse-cdn.com/v4/letter/r/3ec8ea/32.png) [@Ritov](https://forums.rockylinux.org/u/Ritov)\
**Post date:** [April 23, 2024, 5:49pm UTC](https://forums.rockylinux.org/t/dnf-issue-with-ocsp-check-tls-cert/13691/2 "2024-04-23T17:49:07Z")

</div>

I found out that our infra has `sslverifystatus` for all repos enabled. Until now, this never was a problem. I wonder who could address this issue, as OCSP is a common measure. `mirrors.rockylinux.org` is hosted by Fastly and OCSP status is normaly provided by the TLS terminating server (\>Fastly). Any hints?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex020/uploads/rockylinux/original/1X/91b7219eec10e30013422e4df76c1d898711a5d5.svg) [@system](https://forums.rockylinux.org/u/system)\
**Post date:** [June 22, 2024, 5:49pm UTC](https://forums.rockylinux.org/t/dnf-issue-with-ocsp-check-tls-cert/13691/3 "2024-06-22T17:49:47Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.