OCSP stapling in Nginx - Practice Problems & Coding Challenges

Challenge - 5 Problems

💻 Command Output

intermediate

OCSP Stapling Status Check

You run the command openssl s_client -connect example.com:443 -status to check OCSP stapling on a server. What output indicates that OCSP stapling is working correctly?

A OCSP response: Response verify OK

B OCSP response: no response sent

C OCSP response: error parsing response

D OCSP response: response expired

💡 Hint

Look for a message that confirms the OCSP response is valid and verified.

The message 'Response verify OK' means the server sent a valid OCSP response, confirming stapling is working.

❓ Configuration

intermediate

Enable OCSP Stapling in Nginx

Which Nginx configuration snippet correctly enables OCSP stapling for a server block?

A

ssl_stapling on;
resolver 127.0.0.1;
ssl_stapling_verify off;

B

ssl_ocsp on;
ssl_ocsp_verify on;

C

ssl_stapling on;
ssl_stapling_verify on;
resolver 8.8.8.8 8.8.4.4 valid=300s;
resolver_timeout 5s;

D

ssl_stapling off;
ssl_stapling_verify off;

💡 Hint

You need to enable stapling and verification, and specify a valid resolver.

Option C correctly enables OCSP stapling and verification and sets public DNS resolvers with timeout.

❓ Troubleshoot

advanced

Troubleshooting OCSP Stapling Failures

After enabling OCSP stapling, your Nginx error log shows: no responder URL in OCSP response. What is the most likely cause?

A The SSL certificate does not include an OCSP responder URL.

B The resolver IP addresses are unreachable.

C The SSL certificate is expired.

D The server block is missing the 'ssl on;' directive.

💡 Hint

Think about what the OCSP response needs to include to be valid.

If the certificate lacks an OCSP responder URL, Nginx cannot fetch the OCSP response, causing this error.

🔀 Workflow

advanced

OCSP Stapling Renewal Workflow

Which sequence correctly describes the steps Nginx follows to maintain OCSP stapling during operation?

A 2,1,3,4

B 1,3,2,4

C 1,2,4,3

D 1,2,3,4

💡 Hint

Think about fetching, caching, serving, then renewing the OCSP response.

Nginx first fetches the OCSP response, caches it, serves it during TLS handshakes, and renews it before expiry.

✅ Best Practice

expert

Best Practice for OCSP Stapling Resolver Configuration

Which resolver configuration is best practice for OCSP stapling in Nginx to ensure reliability and security?

A resolver 0.0.0.0 valid=300s; resolver_timeout 5s;

B resolver 8.8.8.8 8.8.4.4 valid=300s; resolver_timeout 5s;

C resolver 127.0.0.1 valid=300s; resolver_timeout 5s;

D resolver 192.168.1.1 valid=300s; resolver_timeout 5s;

💡 Hint

Use public, reliable DNS servers for OCSP resolver settings.

Using public DNS servers like Google's 8.8.8.8 and 8.8.4.4 ensures reliable OCSP response fetching.

Practice

1. What is the main purpose of enabling OCSP stapling in nginx?

easy

A. To encrypt the website traffic with a stronger cipher

B. To block unauthorized IP addresses automatically

C. To speed up HTTPS by caching the certificate status

D. To compress website content for faster loading

Solution

1. Step 1: Understand OCSP stapling concept

   OCSP stapling allows the server to cache the certificate status from the certificate authority, reducing the need for clients to query it directly.

2. Step 2: Identify the main benefit in nginx

   This caching speeds up HTTPS connections by reducing latency and improving performance.

3. Final Answer:

   To speed up HTTPS by caching the certificate status -> Option C

4. Quick Check:

   OCSP stapling = speed up HTTPS [OK]

Hint: OCSP stapling caches cert status to speed HTTPS [OK]

Common Mistakes:

• Confusing OCSP stapling with encryption methods
• Thinking it blocks IP addresses
• Assuming it compresses website content

2. Which of the following is the correct nginx directive to enable OCSP stapling?

easy

A. ssl_ocsp on;

B. ssl_stapling_enable true;

C. ssl_ocsp_stapling enable;

D. ssl_stapling on;

Solution

1. Step 1: Recall nginx directive syntax for OCSP stapling

   The correct directive to enable OCSP stapling in nginx is ssl_stapling on;.

2. Step 2: Check each option for syntax correctness

   Options A, B, and C use incorrect directive names or syntax.

3. Final Answer:

   ssl_stapling on; -> Option D

4. Quick Check:

   Enable OCSP stapling with ssl_stapling on; [OK]

Hint: Use ssl_stapling on; to enable OCSP stapling [OK]

Common Mistakes:

• Using incorrect directive names like ssl_ocsp
• Adding extra words like _enable or enable
• Using true/false instead of on/off

3. Given this nginx snippet, what will happen if ssl_stapling is enabled but resolver is not set?

server {
  listen 443 ssl;
  ssl_certificate /etc/ssl/cert.pem;
  ssl_certificate_key /etc/ssl/key.pem;
  ssl_stapling on;
}

medium

A. nginx will log errors but continue running without stapling

B. nginx will fail to start due to missing resolver

C. OCSP stapling will be disabled silently

D. OCSP stapling will work normally without issues

Solution

1. Step 1: Understand resolver role in OCSP stapling

   nginx needs a DNS resolver configured to fetch OCSP responses from the certificate authority.

2. Step 2: Analyze behavior without resolver

   If no resolver is set, nginx cannot fetch OCSP responses, so it logs errors but continues running without stapling.

3. Final Answer:

   nginx will log errors but continue running without stapling -> Option A

4. Quick Check:

   Missing resolver = errors logged, no stapling [OK]

Hint: Missing resolver logs errors, disables stapling silently [OK]

Common Mistakes:

• Assuming nginx fails to start
• Thinking stapling works without resolver
• Believing stapling disables silently without logs

4. You enabled ssl_stapling on; and set a resolver, but nginx still does not staple OCSP responses. What is the most likely cause?

medium

A. The SSL certificate does not include the OCSP responder URL

B. The ssl_certificate_key file is missing

C. The server is listening on port 80 instead of 443

D. The ssl_protocols directive is missing

Solution

1. Step 1: Check prerequisites for OCSP stapling

   OCSP stapling requires the SSL certificate to include an OCSP responder URL to fetch status.

2. Step 2: Identify why stapling fails despite correct config

   If the certificate lacks the OCSP responder URL, nginx cannot get the status, so stapling fails.

3. Final Answer:

   The SSL certificate does not include the OCSP responder URL -> Option A

4. Quick Check:

   Missing OCSP URL in cert = stapling fails [OK]

Hint: Cert must have OCSP URL for stapling to work [OK]

Common Mistakes:

• Thinking missing key file causes stapling failure
• Confusing HTTP port with SSL port
• Assuming ssl_protocols affects stapling directly

5. You want to enable OCSP stapling in nginx with these requirements: - Use Google's public DNS resolver - Enable stapling - Ensure nginx reloads config safely Which configuration snippet correctly achieves this?

server {
  listen 443 ssl;
  ssl_certificate /etc/ssl/cert.pem;
  ssl_certificate_key /etc/ssl/key.pem;
  # Your config here
}

hard

A. resolver 8.8.8.8;
ssl_stapling off;
ssl_stapling_verify on;

B. resolver 8.8.8.8 8.8.4.4 valid=300s;
ssl_stapling on;
ssl_stapling_verify on;

C. ssl_stapling on;
ssl_stapling_verify off;
resolver 1.1.1.1;

D. resolver 8.8.8.8 8.8.4.4;
ssl_stapling on;
ssl_stapling_verify off;

Solution

1. Step 1: Set resolver with Google's DNS and validity

   Use resolver 8.8.8.8 8.8.4.4 valid=300s; to specify DNS servers and cache time.

2. Step 2: Enable OCSP stapling and verification

   Set ssl_stapling on; and ssl_stapling_verify on; to enable stapling and verify OCSP responses.

3. Step 3: Confirm safe reload

   After config changes, run nginx -t to test and nginx -s reload to reload safely.

4. Final Answer:

   resolver 8.8.8.8 8.8.4.4 valid=300s; ssl_stapling on; ssl_stapling_verify on; -> Option B

5. Quick Check:

   Correct resolver + stapling on + verify on = resolver 8.8.8.8 8.8.4.4 valid=300s; ssl_stapling on; ssl_stapling_verify on; [OK]

Hint: Use resolver with valid=, enable stapling and verify on [OK]

Common Mistakes:

• Forgetting ssl_stapling_verify on
• Using only one resolver without valid time
• Disabling stapling or verification accidentally