# Ocsp-updates and proxy server problem

**URL:** <https://discourse.haproxy.org/t/ocsp-updates-and-proxy-server-problem/10015>\
**Category:** Help!\
**Created:** [July 10, 2024, 1:21pm UTC](https://discourse.haproxy.org/t/ocsp-updates-and-proxy-server-problem/10015 "2024-07-10T13:21:42Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Vince11215](https://avatars.discourse-cdn.com/v4/letter/v/bc79bd/32.png) [@Vince11215](https://discourse.haproxy.org/u/Vince11215)\
**Post date:** [July 10, 2024, 1:21pm UTC](https://discourse.haproxy.org/t/ocsp-updates-and-proxy-server-problem/10015/1 "2024-07-10T13:21:42Z")

</div>

Hi!

I’m setting up OCSP with Haproxy 3.0.2

Everything is good and well if I download the ocsp repsonse file myself with openssl

But If I’m trying to have haproxy get oscp updates, it fails because I need to go through a corporate proxy to reach out to the issuer URI.

By searching online I found that Apache has an option [SSLOCSPProxyURL](https://httpd.apache.org/docs/current/mod/mod_ssl.html#page-header) to do exactly that, I was hoping there was the equivalent with HAProxy.

The only thing I could find here is [this person](https://discourse.haproxy.org/t/ocsp-update-haproxy-8-2/9176/9) having the same question at the end of a topic.

Thanks

---

<div class="post-metadata">

**Author:** ![xanaxalan](https://avatars.discourse-cdn.com/v4/letter/x/57b2e6/32.png) [@xanaxalan](https://discourse.haproxy.org/u/xanaxalan)\
**Post date:** [July 11, 2024, 6:58am UTC](https://discourse.haproxy.org/t/ocsp-updates-and-proxy-server-problem/10015/2 "2024-07-11T06:58:07Z")

</div>

Yep, on 8.x I did not find a way to set this up, on your version did you configure this: [HAProxy version 3.0.2-34 - Configuration Manual](https://docs.haproxy.org/3.0/configuration.html#3.1-ocsp-update.httpproxy)

> Allow to use an HTTP proxy for the OCSP updates. This only works with HTTP,  
> HTTPS is not supported. This option will allow the OCSP updater to send  
> absolute URI in the request to the proxy.

---

<div class="post-metadata">

**Author:** ![Vince11215](https://avatars.discourse-cdn.com/v4/letter/v/bc79bd/32.png) [@Vince11215](https://discourse.haproxy.org/u/Vince11215)\
**Post date:** [July 11, 2024, 5:50pm UTC](https://discourse.haproxy.org/t/ocsp-updates-and-proxy-server-problem/10015/3 "2024-07-11T17:50:28Z")

</div>

Thanks Alan!

That fixed my issue… I had browsed through the doc, problem is that searching for “proxy” in the haproxy documentation does not really help !

The only problem I’ll mention, is that it forces me to use the IP address of my proxy server, if I use the hostname it does not even tries to resolve the name and I get the error:

> [ALERT] (1) : config : ocsp-update: Failed to parse destination address in invalid address: ‘my.proxy.dns.name’ in ‘my.proxy.dns.name:8080’  
> [ALERT] (1) : config : parsing [/usr/local/etc/haproxy/haproxy.cfg:25] : (null)  
> [ALERT] (1) : config : Error(s) found in configuration file : /usr/local/etc/haproxy/haproxy.cfg  
> [ALERT] (1) : config : Fatal errors found in configuration.