title: openssl / libressl ocsp responder missing response for expired/revoked certificates
body: <p>For some reason, an OpenSSL OCSP responder doesn't seem to deliver any responses for expired or revoked certificates. For valid certificates, everything is fine.</p>
  
  <p>Tested this on LibreSSL 2.2.7 (on MacOS). For reference, I also tested this on the very old OpenSSL 0.9.8f, same issue.</p>
  
  <p><strong>Setup</strong></p>
  
  <p>File index.txt (Fields are tab separated):</p>
  
  <pre><code>V   20991231235959Z     32F31   unknown /CN=valid01
  V   20991231235959Z     32F32   unknown /CN=valid02
  V   20991231235959Z     32F33   unknown /CN=valid03
  E   20171231235959Z     32F34   unknown /CN=expired01
  E   20171231235959Z     32F35   unknown /CN=expired02
  E   20171231235959Z     32F36   unknown /CN=expired03
  R   20171231235959Z 20160631235959Z 32F37   unknown /CN=revoked01
  R   20171231235959Z 20160631235959Z 32F38   unknown /CN=revoked02
  R   20171231235959Z 20160631235959Z 32F39   unknown /CN=revoked03
  V   20991231235959Z     32F3A   unknown /CN=valid04
  </code></pre>
  
  <p>File index.txt.attr:</p>
  
  <pre><code>unique_subject = yes
  </code></pre>
  
  <p>File ca.pem:</p>
  
  <pre><code>(Please create your own, self-signed ca with key)
  </code></pre>
  
  <p>Start OCSP responder using</p>
  
  <pre><code>openssl ocsp -index index.txt -port 8084 -rkey ca.pem -rsigner ca.pem -CA ca.pem -text -resp_no_certs
  </code></pre>
  
  <p><strong>Test</strong></p>
  
  <p>Query valid certificate (no problem here):</p>
  
  <pre><code>$ openssl ocsp -issuer ca.pem -serial 0x32f31 -url http://localhost:8084 -noverify
  0x32f31: good
      This Update: Sep 27 12:46:06 2018 GMT
  </code></pre>
  
  <p>Query expired or revoked certficate (misings response):</p>
  
  <pre><code>$ openssl ocsp -issuer ca.pem -serial 0x32f36 -url http://localhost:8084 -noverify
  0x32f36: ERROR: No Status found.
  </code></pre>
  
  <p>What went wrong?</p>