Repository: certbot/certbot

Issue:
Invalid OCSP response for /etc/letsencrypt/live/.../cert.pem: param thisUpdate is in the future..
If you're having trouble using Certbot and aren't sure you've found a bug or
request for a new feature, please first try asking for help at
https://community.letsencrypt.org/. There is a much larger community there of
people familiar with the project who will be able to more quickly answer your
questions.

## My operating system is (include version):
CentOS release 6.10 (Final)

## I installed Certbot with (certbot-auto, OS package manager, pip, etc):
certbot-auto

## I ran this command and it produced this output:
certbot-auto --no-self-upgrade

## Certbot's behavior differed from what I expected because:
Invalid OCSP response for /etc/letsencrypt/live/.../cert.pem: param thisUpdate is in the future..

## Here is a Certbot log showing the issue (if available):
###### Logs are stored in `/var/log/letsencrypt` by default. Feel free to redact domains, e-mail and IP addresses as you see fit.
```
2019-03-09 20:39:02,485:DEBUG:urllib3.connectionpool:Starting new HTTP connection (1): ocsp.int-x3.letsencrypt.org:80
2019-03-09 20:39:02,581:DEBUG:urllib3.connectionpool:http://ocsp.int-x3.letsencrypt.org:80 "POST / HTTP/1.1" 200 527
2019-03-09 20:39:02,587:ERROR:certbot.ocsp:Invalid OCSP response for /etc/letsencrypt/live/.../cert.pem: param thisUpdate is in the future..
2019-03-09 20:39:02,594:DEBUG:urllib3.connectionpool:Starting new HTTP connection (1): ocsp.int-x3.letsencrypt.org:80
2019-03-09 20:39:02,703:DEBUG:urllib3.connectionpool:http://ocsp.int-x3.letsencrypt.org:80 "POST / HTTP/1.1" 200 527
2019-03-09 20:39:02,705:ERROR:certbot.ocsp:Invalid OCSP response for /etc/letsencrypt/live/.../cert.pem: param thisUpdate is in the future..
/
```

This has happened on two computers in two very different infrastructure systems

## Here is the relevant nginx server block or Apache virtualhost for the domain I am configuring:



Discussion:
Hello @jsoref, two questions to precise the context.

First, is this error blocks your instance of Certbot to operate normally? Second, could you check that the local time of your two systems are not desynchronized from the official time? 
* I have no idea, I think renew dry run seemed to work
* Define desynchronized, they have ntp&ntpdate installed and enabled
Any reason why you use `--no-self-upgrade` ? What is your current version of certbot (`certbot-auto --no-self-upgrade --version`) ?

Also, what is your time zone? 
This bug was reported in real time, so this system was using a Pacific time zone.

No self update is to avoid moving parts. It didn't update when I ran without and didn't change the outcome when I repeated it.
Found it! Dates in OCSP response are expressed in UTC, and Certbot compares them with a date expressed in the local time of the machine.

Corrective PR is on its way. 

Thanks for your report! 

Resolving patch:
diff --git a/certbot/ocsp.py b/certbot/ocsp.py
--- a/certbot/ocsp.py
+++ b/certbot/ocsp.py
@@ -200,7 +200,7 @@ def _check_ocsp_response(response_ocsp, request_ocsp, issuer_cert):
     #      for OpenSSL, so we do not do it here.
     # See OpenSSL implementation as a reference:
     # https://github.com/openssl/openssl/blob/ef45aa14c5af024fcb8bef1c9007f3d1c115bd85/crypto/ocsp/ocsp_cl.c#L338-L391
-    now = datetime.now()
+    now = datetime.utcnow()  # thisUpdate/nextUpdate are expressed in UTC/GMT time zone
     if not response_ocsp.this_update:
         raise AssertionError('param thisUpdate is not set.')
     if response_ocsp.this_update > now + timedelta(minutes=5):


Test patch: