ocsp-server doesn't run with sqlite

[ruomad]

Hello I'm trying to test the server with SQLite, but it silently exits without any message. Is there a way to know what is wrong (config file ?)
I tested it with the provided binary (ubuntu) and with a self compiled server on freebsd, no joy and same symptoms
Any clue ?

[DorianCoding]

Hello,

Yes it seems the Github actions generates an invalid binary, I will take a look. Compiling should however work.

[DorianCoding]

Can you try with the new version?

[ruomad]

I tried, no change, sorry.
No output at all when I run ocsp-server config.toml
If I make an error in config file I get output

BTW ocsp-server -V reports 0.7.0 even with new version

[ruomad]

I tried, no change, sorry. No output at all when I run ocsp-server config.toml If I make an error in config file I get output BTW ocsp-server -V reports 0.7.0 even with new version

…

On 20/05/2026 19:42, Guilhem wrote: *DorianCoding* left a comment (DorianCoding/OCSP-server#24) <#24 (comment)> Can you try with the new version? — Reply to this email directly, view it on GitHub <#24 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AECOISDWFV35GKPHN4K6CBL43XU77AVCNFSM6AAAAACZFCTSU6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHM2DKMBQHE4TQMJVGE>. You are receiving this because you authored the thread.Message ID: ***@***.***>

[DorianCoding]

Have you installed libmysqlclient-dev ?

[ruomad]

To use sqlite ? no

[DorianCoding]

To use sqlite ? no

The binary compiles all features such as mysql and requires the library. If you want only one feature you need to compile with this specific feature and the library won't be needed.

[ruomad]

well I tried even with a mysql database and starting the server as a ubuntu (WSL) service but if still fails to start... thinking of giving up ;-)

[DorianCoding]

Try with this binary: https://github.com/DorianCoding/OCSP-server/releases/download/v0.7.1/ocsp-server

Type ldd also to check required libraries and if they are present.

[ruomad]

Thanks a lot, I tried it. ldd was reporting a unknown library libmariadb so I installed libmariadb-dev but it still doesn't start at all, very frustrating, I must be missing something...
The syslog shows only (lauching the service):
2026-05-25T07:13:51.212830+02:00 jopin systemd[1]: ocspserver.service: Start request repeated too quickly.
2026-05-25T07:13:51.212969+02:00 jopin systemd[1]: ocspserver.service: Failed with result 'exit-code'.
2026-05-25T07:13:51.213019+02:00 jopin systemd[1]: Failed to start ocspserver.service - OCSP Server.
If I launch directly the binary there is no output at all. Isn't there a way to get some debug output ?

[ruomad]

OK I succeeded to launch it ! I had a wrong password in mysql in my config file. sorry for this.
I will now try to use other params. Thanks again

[ruomad]

findings:

• itkey must be in pkcs8 DER format (unencrypted key)
• postgres and mysql working as expected
• sqlite works only with create_table = false
• dbuser and dbpassword must be set even if they are unused in sqlite

[ruomad]

additionnally : certnum must be lowercase
I get correct responses for all my certs except one where I get status 'unknown' instead of good, what can be the reason for this ?
My current OCSP responder answers good for the same cert (from a crl which I imported in sql db)

[ruomad]

the problematic cert is serial 0x3d.

openssl ocsp -CAfile tls_ca_bundle.crt -issuer tls_ca.crt -serial 0x3d -url http://127.0.0.1:9000
WARNING: no nonce in response
Response verify OK
0x3d: unknown
        This Update: May 25 07:53:00 2026 GMT
        Next Update: May 28 07:53:00 2026 GMT

and in db

sqlite3 /var/ocsp/tls_certs.db
SQLite version 3.45.1 2024-01-30 16:01:20
Enter ".help" for usage hints.
sqlite> select * from custom_certs where cert_num = '0x3d';
0x3d||unspecified|Valid

[ruomad]

OK problem solved, it was the cache kicking in with a stale answer as I tested this cert before with a capitalized version of cert_num in the database (0x3D was not found).

[ruomad]

Also I would very much be able to use this for several issuers (as I have a CA with some sub-CAs).
AFAIK this would only require some modifications in your code

• extract authorityKeyIdentifier from the request
• add a corresponding field to database structure
• match request on both cert_num and authorityKeyIdentifier
  Is this something you could consider implementing ?

background : I'm looking to replace openca-ocspd which FreeBSD port I am maintaining as upstream seems mostly dead and also as the complexity of the underlying libpki is really overkill

[DorianCoding]

I add a feature for sqlite instead of keeping it by default.

findings:

* itkey must be in pkcs8 DER format (unencrypted key)

* postgres and mysql working as expected

* sqlite works only with create_table = false

* dbuser and dbpassword must be set even if they are unused in sqlite

I can investigate the two last points. Regarding the first one, I think it is a dependancy requirement.

OK problem solved, it was the cache kicking in with a stale answer as I tested this cert before with a capitalized version of cert_num in the database (0x3D was not found).

Yes there is a cache that you can disable on the config.

• extract authorityKeyIdentifier from the request

• add a corresponding field to database structure

• match request on both cert_num and authorityKeyIdentifier
  Is this something you could consider implementing ?

Yes I will think of it. However we need also to implement multiple itkeys and certificate as files and change the database while keeping backward-compatibility.

[ruomad]

Yes! Now when I think of it multiple itkeys an certificates would also be needed however, because I have a signing certificate per subCA (signed by the sub CA) so the steps I mentioned wouldn't be sufficient.

Regarding the DER requirement, I can live with it, it just should be stated somewhere though (config file template ? or README)