Discovery fail because of OCSP revocation check (Azure and other APIs)

Please use this information, if for some reason, you have issues with OCSP. I faced this issue with Azure Monitor connectivity.

Issue

How to know OCSP URL for a certificate?

Choice 3 : It is also possible to use command line on certificate :

openssl x509 -in cert.pem -noout -ocsp_uri

Example of logs :

From the logs of the MID, Example of logs.

2023-05-17T07:34:17.046+0000 DEBUG (Worker-Interactive:ConnectorProbe-ea703de21bb2e910255c964b9b4bcbfa) [MIDTLSPolicy:77] MIDSecPolicy: Certificate revocation check for host[login.microsoftonline.com] is true
2023-05-17T07:34:17.078+0000 WARN  (Worker-Interactive:ConnectorProbe-ea703de21bb2e910255c964b9b4bcbfa) [OCSPCheck:539] OCSPCheck authority: http://ocsp.digicert.com, error: java.net.SocketException: Connection reset
2023-05-17T07:34:17.078+0000 WARN  (Worker-Interactive:ConnectorProbe-ea703de21bb2e910255c964b9b4bcbfa) [HTTPClient:830] Socket error
2023-05-17T07:34:17.078+0000 WARN  (Worker-Interactive:ConnectorProbe-ea703de21bb2e910255c964b9b4bcbfa) [GlideSSLProtocolSocketFactory:509] OCSP revoke check IOException for stamp2.login.microsoftonline.com

Here we can see that the MID refused to connect to "login.microsoftonline.com", as it was not able to reach the OCSP URL (http://ocsp.digicert.com)

Resolution of the issue

Labels: