Hi, I had setup and got OCSP working with Freeradius in early 2016. However, I've recently noticed that it's not working anymore, as users with a revoked certificate are still able to connect to the network due to softfail being enabled. I'm using the Debian Stretch package of Freeradius : freeradius -v radiusd: FreeRADIUS Version 3.0.12, for host x86_64-pc-linux-gnu, built on Aug 10 2017 at 07:05:06 FreeRADIUS Version 3.0.12 Our company is using its own PKI, managed with EasyRSA. Every user certificate is signed directly with our CA certificate. Here's our TLS configuration for the EAP module : tls-config tls-common { private_key_file = ${certdir}/server.key certificate_file = ${certdir}/server.crt ca_file = ${cadir}/ca.crt dh_file = ${certdir}/dh2048.pem ca_path = ${cadir} check_cert_issuer = "/C=EU/ST=SomeState/L=SomeCity/O=MyCompany/OU=Internal/CN=MyCA/name=EasyRSA/emailAddress=<redacted>" cipher_list = "DEFAULT" ecdh_curve = "prime256v1" cache { [...] } verify { [...] } ocsp { enable = yes override_cert_url = yes url = "http://mycompany.local/ocsp" use_nonce = yes timeout = 0 softfail = yes } } When starting Freeradius in debug mode, I'm getting the following error : (7) eap_tls: Continuing EAP-TLS (7) eap_tls: Got final TLS record fragment (284 bytes) (7) eap_tls: [eaptls verify] = ok (7) eap_tls: Done initial handshake (7) eap_tls: TLS_accept: SSLv3/TLS write server done (7) eap_tls: <<< recv TLS 1.2 [length 0a78] (7) eap_tls: Creating attributes from certificate OIDs (7) eap_tls: TLS-Cert-Serial := "9de69ecd874173d2" (7) eap_tls: TLS-Cert-Expiration := "251220162210Z" (7) eap_tls: TLS-Cert-Subject := "/C=EU/ST=SomeState/L=SomeCity/O=MyCompany/OU=Internal/CN=MyCA/name=EasyRSA/emailAddress=<redacted>" (7) eap_tls: TLS-Cert-Issuer := "/C=EU/ST=SomeState/L=SomeCity/O=MyCompany/OU=Internal/CN=MyCA/name=EasyRSA/emailAddress=<redacted>" (7) eap_tls: TLS-Cert-Common-Name := "Nameshield CA" (7) eap_tls: Creating attributes from certificate OIDs (7) eap_tls: TLS-Client-Cert-Serial := "011b" (7) eap_tls: TLS-Client-Cert-Expiration := "290128160026Z" (7) eap_tls: TLS-Client-Cert-Subject := "/C=EU/ST=SomeState/L=SomeCity/O=MyCompany/OU=Internal/CN=user/name=EasyRSA/emailAddress=<redacted>" (7) eap_tls: TLS-Client-Cert-Issuer := "/C=EU/ST=SomeState/L=SomeCity/O=MyCompany/OU=Internal/CN=MyCA/name=EasyRSA/emailAddress=<redacted>" (7) eap_tls: TLS-Client-Cert-Common-Name := "user" (7) eap_tls: TLS-Client-Cert-Subject-Alt-Name-Dns := "user" (7) eap_tls: TLS-Client-Cert-X509v3-Basic-Constraints += "CA:FALSE" (7) eap_tls: TLS-Client-Cert-X509v3-Subject-Key-Identifier += "<redacted>" (7) eap_tls: TLS-Client-Cert-X509v3-Authority-Key-Identifier += "keyid:<redacted>\nDirName:/C=EU/ST=SomeState/L=SomeCity/O=Nameshield/OU=Internal/CN=MyCA/name=EasyRSA/emailAddress=<redacted>\nse" (7) eap_tls: TLS-Client-Cert-X509v3-Extended-Key-Usage += "TLS Web Client Authentication" (7) eap_tls: Starting OCSP Request *(7) eap_tls: ERROR: Couldn't get issuer_cert for user* (7) eap_tls: TLS_accept: SSLv3/TLS read client certificate (7) eap_tls: <<< recv TLS 1.2 [length 0046] (7) eap_tls: TLS_accept: SSLv3/TLS read client key exchange (7) eap_tls: <<< recv TLS 1.2 [length 0108] (7) eap_tls: TLS_accept: SSLv3/TLS read certificate verify (7) eap_tls: TLS_accept: SSLv3/TLS read change cipher spec (7) eap_tls: <<< recv TLS 1.2 [length 0010] (7) eap_tls: TLS_accept: SSLv3/TLS read finished (7) eap_tls: >>> send TLS 1.2 [length 0001] (7) eap_tls: TLS_accept: SSLv3/TLS write change cipher spec (7) eap_tls: >>> send TLS 1.2 [length 0010] (7) eap_tls: TLS_accept: SSLv3/TLS write finished (7) eap_tls: (other): SSL negotiation finished successfully (7) eap_tls: SSL Connection Established (7) eap_tls: [eaptls process] = handled (7) eap: Sending EAP Request (code 1) ID 9 length 61 (7) eap: EAP session adding &reply:State = 0xbef729bab9fe249e After looking for a solution for a few hours, I'm pretty much out of ideas. I'm not finding any reference to this error message aside from the source code. Do you have any idea what could cause this issue? Thanks! Regards, Antoine