OCSP stapling in Nginx - Time & Space Complexity

Time Complexity: OCSP stapling

O(n)

Understanding Time Complexity

We want to understand how the time needed to check certificate status grows when using OCSP stapling in nginx.

Specifically, how does nginx handle OCSP responses as requests increase?

Scenario Under Consideration

Analyze the time complexity of the following nginx OCSP stapling configuration snippet.

ssl_stapling on;
ssl_stapling_verify on;
resolver 8.8.8.8 8.8.4.4 valid=300s;
resolver_timeout 5s;

server {
    listen 443 ssl;
    ssl_certificate /etc/ssl/certs/example.crt;
    ssl_certificate_key /etc/ssl/private/example.key;
}
    

This snippet enables OCSP stapling and verification, sets DNS resolvers, and configures SSL certificates for a server.

Identify Repeating Operations

Identify the loops, recursion, array traversals that repeat.

• Primary operation: nginx periodically fetches and caches OCSP responses from the certificate authority.
• How many times: This happens at fixed intervals (every few minutes), not per client request.

How Execution Grows With Input

OCSP stapling fetches the certificate status once and reuses it for many client requests.

Input Size (n)	Approx. Operations
10 requests	1 OCSP fetch + 10 fast response deliveries
100 requests	1 OCSP fetch + 100 fast response deliveries
1000 requests	1 OCSP fetch + 1000 fast response deliveries

Pattern observation: The expensive OCSP fetch happens rarely and does not grow with requests; delivering cached responses scales linearly and is very fast.

Final Time Complexity

Time Complexity: O(n)

This means the time to serve OCSP stapled responses grows linearly with the number of client requests, but the costly OCSP fetch happens only occasionally.

Common Mistake

[X] Wrong: "nginx fetches OCSP status for every client request, causing slowdowns as requests grow."

[OK] Correct: nginx caches the OCSP response and reuses it for many requests, so fetching happens rarely, not per request.

Interview Connect

Understanding how nginx handles OCSP stapling shows you can reason about caching and repeated operations in real systems, a useful skill for many DevOps roles.

Self-Check

"What if nginx did not cache OCSP responses and fetched them for every request? How would the time complexity change?"