You are viewing a plain text version of this content. The canonical link for it is here.
Posted to github@trafficserver.apache.org by "ezelkow1 (via GitHub)" <gi...@apache.org> on 2026/06/23 02:16:23 UTC
[PR] Change ocsp error log back to debug [trafficserver]
ezelkow1 opened a new pull request, #13312:
URL: https://github.com/apache/trafficserver/pull/13312
This message can get a bit spammy
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Throttle OCSP cert-status error instead of logging on every handshake [trafficserver]
Posted by "ezelkow1 (via GitHub)" <gi...@apache.org>.
ezelkow1 merged PR #13312:
URL: https://github.com/apache/trafficserver/pull/13312
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Change ocsp error log back to debug [trafficserver]
Posted by "bneradt (via GitHub)" <gi...@apache.org>.
bneradt commented on code in PR #13312:
URL: https://github.com/apache/trafficserver/pull/13312#discussion_r3461255320
##########
src/iocore/net/OCSPStapling.cc:
##########
@@ -1421,7 +1421,7 @@ ssl_callback_ocsp_stapling(SSL *ssl, void *)
time_t current_time = time(nullptr);
if ((cinf->resp_derlen == 0 || cinf->is_expire) || (cinf->expire_time < current_time && !cinf->is_prefetched)) {
ink_mutex_release(&cinf->stapling_mutex);
- Error("ssl_callback_ocsp_stapling: failed to get certificate status for %s", cinf->certname);
+ Dbg(dbg_ctl_ssl_ocsp, "ssl_callback_ocsp_stapling: failed to get certificate status for %s", cinf->certname);
Review Comment:
Can we turn this into a `SiteThrottledError` instead? That will compromise quieting the loud log that can emit a ton while still alerting ops of some issue with this.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Change ocsp error log back to debug [trafficserver]
Posted by "bneradt (via GitHub)" <gi...@apache.org>.
bneradt commented on code in PR #13312:
URL: https://github.com/apache/trafficserver/pull/13312#discussion_r3460912666
##########
src/iocore/net/OCSPStapling.cc:
##########
@@ -1421,7 +1421,7 @@ ssl_callback_ocsp_stapling(SSL *ssl, void *)
time_t current_time = time(nullptr);
if ((cinf->resp_derlen == 0 || cinf->is_expire) || (cinf->expire_time < current_time && !cinf->is_prefetched)) {
ink_mutex_release(&cinf->stapling_mutex);
- Error("ssl_callback_ocsp_stapling: failed to get certificate status for %s", cinf->certname);
+ Dbg(dbg_ctl_ssl_ocsp, "ssl_callback_ocsp_stapling: failed to get certificate status for %s", cinf->certname);
Review Comment:
Is this OK to downgrade? The other cert related messages in this function are Error. I'm not saying not to downgrade, but I just want to double check this is OK. Doesn't the user need to be alerted to issues like this?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Throttle OCSP cert-status error instead of logging on every handshake [trafficserver]
Posted by "ezelkow1 (via GitHub)" <gi...@apache.org>.
ezelkow1 commented on PR #13312:
URL: https://github.com/apache/trafficserver/pull/13312#issuecomment-4804160031
[approve ci fedora]
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Throttle OCSP cert-status error instead of logging on every handshake [trafficserver]
Posted by "cmcfarlen (via GitHub)" <gi...@apache.org>.
cmcfarlen commented on PR #13312:
URL: https://github.com/apache/trafficserver/pull/13312#issuecomment-4897014647
Cherry-picked to 10.2.x
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Change ocsp error log back to debug [trafficserver]
Posted by "ezelkow1 (via GitHub)" <gi...@apache.org>.
ezelkow1 commented on code in PR #13312:
URL: https://github.com/apache/trafficserver/pull/13312#discussion_r3475565555
##########
src/iocore/net/OCSPStapling.cc:
##########
@@ -1421,7 +1421,7 @@ ssl_callback_ocsp_stapling(SSL *ssl, void *)
time_t current_time = time(nullptr);
if ((cinf->resp_derlen == 0 || cinf->is_expire) || (cinf->expire_time < current_time && !cinf->is_prefetched)) {
ink_mutex_release(&cinf->stapling_mutex);
- Error("ssl_callback_ocsp_stapling: failed to get certificate status for %s", cinf->certname);
+ Dbg(dbg_ctl_ssl_ocsp, "ssl_callback_ocsp_stapling: failed to get certificate status for %s", cinf->certname);
Review Comment:
Good call — switched it to `SiteThrottledError` in the latest push. It stays at Error severity so ops are still alerted, but it's now throttled per call site (default `proxy.config.log.throttling_interval_msec` = 60s) and emits a "suppressed N times" count, so a flapping cert won't flood error.log. Also updated the commit message to reflect the new behavior.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org