# OCSP 装订验证失败（SSL：错误：2707307E：OCSP 例程：OCSP_basic_verify：证书验证错误）

- **ID:** `nginx/ssl-ocsp-stapling-verify-failed`
- **领域:** nginx
- **类别:** auth_error
- **验证级别:** ai_generated
- **修复率:** 90%

## 根因

OCSP 装订失败，因为证书链不完整或 OCSP 响应程序证书不受 nginx 的 CA 包信任。

## 版本兼容性

| 版本 | 状态 | 引入 | 弃用 |
|------|------|------|------|
| nginx/1.18.0 | active | — | — |
| nginx/1.20.0 | active | — | — |
| nginx/1.24.0 | active | — | — |
| nginx/1.26.0 | active | — | — |

## 解决方案

1. ```
   确保 ssl_certificate 指定完整的证书链（包括中间 CA）：`cat server.crt intermediate.crt > fullchain.crt` 并设置 `ssl_certificate /path/to/fullchain.crt;`
   ```
2. ```
   将 ssl_trusted_certificate 设置为包含 OCSP 响应程序颁发者的 CA 包：`ssl_trusted_certificate /etc/ssl/certs/ca-bundle.crt;`
   ```
3. ```
   如果使用 Let's Encrypt，请使用 fullchain.pem 文件：`ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;`
   ```

## 无效尝试

- **** — Without verification, nginx will staple any OCSP response, including potentially forged ones, weakening TLS security. (50% 失败率)
- **** — The responder's certificate must be in the trusted store; changing the URL does not fix trust issues. (70% 失败率)
- **** — OCSP responses are signed by the CA, not the server certificate; the CA's certificate must be in the trust chain. (60% 失败率)