OCSP stapling in Nginx - Commands & Configuration

Introduction

Websites use certificates to prove they are secure. OCSP stapling helps speed up checking if a certificate is still valid by letting the website share this info directly, so visitors don't have to ask the certificate authority every time.

When you want your website to load faster by reducing certificate checks.

When you want to reduce the load on the certificate authority servers.

When you want to improve privacy by not letting visitors directly contact the certificate authority.

When you have an HTTPS website using SSL/TLS certificates.

When you want to avoid browser warnings about certificate revocation delays.

Config File - nginx.conf

nginx.conf

server {
    listen 443 ssl;
    server_name example.com;

    ssl_certificate /etc/ssl/certs/example.com.crt;
    ssl_certificate_key /etc/ssl/private/example.com.key;

    ssl_stapling on;
    ssl_stapling_verify on;

    resolver 8.8.8.8 8.8.4.4 valid=300s;
    resolver_timeout 5s;

    location / {
        root /var/www/html;
        index index.html;
    }
}

ssl_certificate and ssl_certificate_key specify your site's certificate and private key.

ssl_stapling on; enables OCSP stapling to send certificate status to clients.

ssl_stapling_verify on; makes nginx check the OCSP response from the certificate authority.

resolver sets DNS servers nginx uses to fetch OCSP responses.

Commands

Check the nginx configuration file for syntax errors before applying changes.

Terminal

sudo nginx -t

Expected Output

nginx: the configuration file /etc/nginx/nginx.conf syntax is ok

nginx: configuration file /etc/nginx/nginx.conf test is successful

Reload nginx to apply the new configuration without stopping the server.

Terminal

sudo systemctl reload nginx

Expected Output

No output (command runs silently)

Check if OCSP stapling is working by connecting to the server and requesting the OCSP status.

Terminal

openssl s_client -connect example.com:443 -status

Expected Output

CONNECTED(00000003)

...

OCSP response: successful

...

---

SSL handshake has read 3456 bytes and written 456 bytes

Verification: OK

---

Key Concept

If you remember nothing else from OCSP stapling, remember: it lets your server send certificate validity info directly to visitors, speeding up secure connections.

Common Mistakes

Not enabling ssl_stapling_verify after turning on ssl_stapling

Without ssl_stapling_verify, nginx won't check if the OCSP response is valid, risking sending bad info to clients.

Always set ssl_stapling_verify on to ensure nginx verifies the OCSP response.

Not setting a DNS resolver in nginx configuration

Nginx needs DNS servers to fetch OCSP responses; without resolver, stapling won't work.

Add resolver 8.8.8.8 8.8.4.4; or your preferred DNS servers in the nginx config.

Forgetting to reload nginx after changing the config

Changes won't take effect until nginx reloads, so stapling won't be enabled yet.

Run sudo systemctl reload nginx after config changes.

Summary

Enable ssl_stapling and ssl_stapling_verify in nginx to activate OCSP stapling.

Set DNS resolver in nginx config so it can fetch OCSP responses.

Test configuration syntax with nginx -t and reload nginx to apply changes.

Verify OCSP stapling works using openssl s_client with the -status flag.

Practice

1. What is the main purpose of enabling OCSP stapling in nginx?

easy

A. To encrypt the website traffic with a stronger cipher

B. To block unauthorized IP addresses automatically

C. To speed up HTTPS by caching the certificate status

D. To compress website content for faster loading

Solution

1. Step 1: Understand OCSP stapling concept

   OCSP stapling allows the server to cache the certificate status from the certificate authority, reducing the need for clients to query it directly.

2. Step 2: Identify the main benefit in nginx

   This caching speeds up HTTPS connections by reducing latency and improving performance.

3. Final Answer:

   To speed up HTTPS by caching the certificate status -> Option C

4. Quick Check:

   OCSP stapling = speed up HTTPS [OK]

Hint: OCSP stapling caches cert status to speed HTTPS [OK]

Common Mistakes:

• Confusing OCSP stapling with encryption methods
• Thinking it blocks IP addresses
• Assuming it compresses website content

2. Which of the following is the correct nginx directive to enable OCSP stapling?

easy

A. ssl_ocsp on;

B. ssl_stapling_enable true;

C. ssl_ocsp_stapling enable;

D. ssl_stapling on;

Solution

1. Step 1: Recall nginx directive syntax for OCSP stapling

   The correct directive to enable OCSP stapling in nginx is ssl_stapling on;.

2. Step 2: Check each option for syntax correctness

   Options A, B, and C use incorrect directive names or syntax.

3. Final Answer:

   ssl_stapling on; -> Option D

4. Quick Check:

   Enable OCSP stapling with ssl_stapling on; [OK]

Hint: Use ssl_stapling on; to enable OCSP stapling [OK]

Common Mistakes:

• Using incorrect directive names like ssl_ocsp
• Adding extra words like _enable or enable
• Using true/false instead of on/off

3. Given this nginx snippet, what will happen if ssl_stapling is enabled but resolver is not set?

server {
  listen 443 ssl;
  ssl_certificate /etc/ssl/cert.pem;
  ssl_certificate_key /etc/ssl/key.pem;
  ssl_stapling on;
}

medium

A. nginx will log errors but continue running without stapling

B. nginx will fail to start due to missing resolver

C. OCSP stapling will be disabled silently

D. OCSP stapling will work normally without issues

Solution

1. Step 1: Understand resolver role in OCSP stapling

   nginx needs a DNS resolver configured to fetch OCSP responses from the certificate authority.

2. Step 2: Analyze behavior without resolver

   If no resolver is set, nginx cannot fetch OCSP responses, so it logs errors but continues running without stapling.

3. Final Answer:

   nginx will log errors but continue running without stapling -> Option A

4. Quick Check:

   Missing resolver = errors logged, no stapling [OK]

Hint: Missing resolver logs errors, disables stapling silently [OK]

Common Mistakes:

• Assuming nginx fails to start
• Thinking stapling works without resolver
• Believing stapling disables silently without logs

4. You enabled ssl_stapling on; and set a resolver, but nginx still does not staple OCSP responses. What is the most likely cause?

medium

A. The SSL certificate does not include the OCSP responder URL

B. The ssl_certificate_key file is missing

C. The server is listening on port 80 instead of 443

D. The ssl_protocols directive is missing

Solution

1. Step 1: Check prerequisites for OCSP stapling

   OCSP stapling requires the SSL certificate to include an OCSP responder URL to fetch status.

2. Step 2: Identify why stapling fails despite correct config

   If the certificate lacks the OCSP responder URL, nginx cannot get the status, so stapling fails.

3. Final Answer:

   The SSL certificate does not include the OCSP responder URL -> Option A

4. Quick Check:

   Missing OCSP URL in cert = stapling fails [OK]

Hint: Cert must have OCSP URL for stapling to work [OK]

Common Mistakes:

• Thinking missing key file causes stapling failure
• Confusing HTTP port with SSL port
• Assuming ssl_protocols affects stapling directly

5. You want to enable OCSP stapling in nginx with these requirements: - Use Google's public DNS resolver - Enable stapling - Ensure nginx reloads config safely Which configuration snippet correctly achieves this?

server {
  listen 443 ssl;
  ssl_certificate /etc/ssl/cert.pem;
  ssl_certificate_key /etc/ssl/key.pem;
  # Your config here
}

hard

A. resolver 8.8.8.8;
ssl_stapling off;
ssl_stapling_verify on;

B. resolver 8.8.8.8 8.8.4.4 valid=300s;
ssl_stapling on;
ssl_stapling_verify on;

C. ssl_stapling on;
ssl_stapling_verify off;
resolver 1.1.1.1;

D. resolver 8.8.8.8 8.8.4.4;
ssl_stapling on;
ssl_stapling_verify off;

Solution

1. Step 1: Set resolver with Google's DNS and validity

   Use resolver 8.8.8.8 8.8.4.4 valid=300s; to specify DNS servers and cache time.

2. Step 2: Enable OCSP stapling and verification

   Set ssl_stapling on; and ssl_stapling_verify on; to enable stapling and verify OCSP responses.

3. Step 3: Confirm safe reload

   After config changes, run nginx -t to test and nginx -s reload to reload safely.

4. Final Answer:

   resolver 8.8.8.8 8.8.4.4 valid=300s; ssl_stapling on; ssl_stapling_verify on; -> Option B

5. Quick Check:

   Correct resolver + stapling on + verify on = resolver 8.8.8.8 8.8.4.4 valid=300s; ssl_stapling on; ssl_stapling_verify on; [OK]

Hint: Use resolver with valid=, enable stapling and verify on [OK]

Common Mistakes:

• Forgetting ssl_stapling_verify on
• Using only one resolver without valid time
• Disabling stapling or verification accidentally