(2024.12.01 and earlier) Invalid bad cert error when connecting to VDI using a custom domain

When customers deploy the External Resources recipe and RES with a custom portal domain name, CertificateRenewalNode fails to refresh the TLS certificate for VDI connection with the following error in /var/log/user-data.log:

{
  "type": "urn:ietf:params:acme:error:unauthorized",
  "detail": "Error finalizing order :: OCSP must-staple extension is no longer available: see https://letsencrypt.org/2024/12/05/ending-ocsp",
  "status": 403
}

As a result, customers will encounter an error that states net::ERR_CERT_DATE_INVALID (Chrome) or Error code: SSL_ERROR_BAD_CERT_DOMAIN (FireFox) when connecting to their VDIs in the RES web portal.

2024.12.01 and earlier

1. Navigate to the EC2 console. If there is an instance named CertificateRenewalNode- , terminate the instance.
2. Navigate to the Lambda console. Open the source code of the Lambda function named -CertificateRenewalLambda-. Identify the line staring with ./acme.sh --issue --dns dns_aws --ocsp-must-staple --keylength 4096 and remove the --ocsp-must-staple argument.
3. Select Deploy and wait for the code change to take effect.
4. Manually trigger the Lambda function: Go to the Test tab and then select Test. No additional input is required. This should create a certificate EC2 instance that updates the Certificate and PrivateKey secrets in Secret Manager. The instance will be terminated automatically once the secrets are updated.
5. Terminate the existing dcv-gateway instance: <env-name>-vdc-gateway and wait for the auto scaling group to automatically deploy a new one.

Let’s Encrypt is ending OCSP Support in 2025. Starting from January 30, 2025, OCSP Must-Staple requests will fail, unless the requesting account has previously issued a certificate containing the OCSP Must Staple extension. Check https://letsencrypt.org/2024/12/05/ending-ocsp/ for more details.