OCSP stapling in Nginx - Practice Problems & Coding Challenges

Challenge - 5 Problems

💻 Command Output

intermediate

OCSP Stapling Status Check

You run the command openssl s_client -connect example.com:443 -status to check OCSP stapling on a server. What output indicates that OCSP stapling is working correctly?

A OCSP response: Response verify OK

B OCSP response: no response sent

C OCSP response: error parsing response

D OCSP response: response expired

💡 Hint

Look for a message that confirms the OCSP response is valid and verified.

The message 'Response verify OK' means the server sent a valid OCSP response, confirming stapling is working.

❓ Configuration

intermediate

Enable OCSP Stapling in Nginx

Which Nginx configuration snippet correctly enables OCSP stapling for a server block?

A

ssl_stapling on;
resolver 127.0.0.1;
ssl_stapling_verify off;

B

ssl_ocsp on;
ssl_ocsp_verify on;

C

ssl_stapling on;
ssl_stapling_verify on;
resolver 8.8.8.8 8.8.4.4 valid=300s;
resolver_timeout 5s;

D

ssl_stapling off;
ssl_stapling_verify off;

💡 Hint

You need to enable stapling and verification, and specify a valid resolver.

Option C correctly enables OCSP stapling and verification and sets public DNS resolvers with timeout.

❓ Troubleshoot

advanced

Troubleshooting OCSP Stapling Failures

After enabling OCSP stapling, your Nginx error log shows: no responder URL in OCSP response. What is the most likely cause?

A The SSL certificate does not include an OCSP responder URL.

B The resolver IP addresses are unreachable.

C The SSL certificate is expired.

D The server block is missing the 'ssl on;' directive.

💡 Hint

Think about what the OCSP response needs to include to be valid.

If the certificate lacks an OCSP responder URL, Nginx cannot fetch the OCSP response, causing this error.

🔀 Workflow

advanced

OCSP Stapling Renewal Workflow

Which sequence correctly describes the steps Nginx follows to maintain OCSP stapling during operation?

A 2,1,3,4

B 1,3,2,4

C 1,2,4,3

D 1,2,3,4

💡 Hint

Think about fetching, caching, serving, then renewing the OCSP response.

Nginx first fetches the OCSP response, caches it, serves it during TLS handshakes, and renews it before expiry.

✅ Best Practice

expert

Best Practice for OCSP Stapling Resolver Configuration

Which resolver configuration is best practice for OCSP stapling in Nginx to ensure reliability and security?

A resolver 0.0.0.0 valid=300s; resolver_timeout 5s;

B resolver 8.8.8.8 8.8.4.4 valid=300s; resolver_timeout 5s;

C resolver 127.0.0.1 valid=300s; resolver_timeout 5s;

D resolver 192.168.1.1 valid=300s; resolver_timeout 5s;

💡 Hint

Use public, reliable DNS servers for OCSP resolver settings.

Using public DNS servers like Google's 8.8.8.8 and 8.8.4.4 ensures reliable OCSP response fetching.