OCSP stapling in Nginx - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is OCSP stapling in simple terms?

OCSP stapling is a way for a website to quickly prove its security certificate is still valid without making your browser check with the certificate authority every time.

beginner

Why is OCSP stapling better than traditional OCSP checks?

Because it reduces delays and saves bandwidth by letting the server send the certificate status directly, so browsers don’t have to ask the certificate authority each time.

beginner

Which nginx directive enables OCSP stapling?

The directive is ssl_stapling on; inside the server block where SSL is configured.

intermediate

What additional directive should be set with ssl_stapling on; for OCSP stapling to work properly in nginx?

You should also set ssl_stapling_verify on; to make nginx verify the OCSP response from the certificate authority.

intermediate

What files are important for OCSP stapling to work in nginx?

You need your SSL certificate file, the private key file, and the trusted certificate chain file (usually the CA bundle) for nginx to verify OCSP responses.

What does OCSP stapling help improve?

A Website loading speed and security certificate validation

B Database query performance

C User interface design

D Server hardware cooling

OCSP stapling helps by speeding up certificate validation and improving security during HTTPS connections.

Which nginx directive turns on OCSP stapling?

A ssl_certificate on;

B ssl_stapling on;

C ssl_verify_client on;

D ssl_protocols on;

The directive ssl_stapling on; enables OCSP stapling in nginx.

What must nginx verify to ensure OCSP stapling works securely?

A The OCSP response from the certificate authority

B The server's IP address

C The user's browser version

D The server's disk space

Nginx verifies the OCSP response to ensure the certificate status is valid and trustworthy.

What file is NOT needed for OCSP stapling in nginx?

A SSL private key file

B Trusted CA certificate chain file

C SSL certificate file

D User's browser cache

User's browser cache is unrelated to nginx's OCSP stapling configuration.

What problem does OCSP stapling solve?

A Increases server CPU speed

B Fixes broken HTML tags

C Avoids delays caused by browsers checking certificate status directly

D Improves database indexing

OCSP stapling avoids delays by letting the server provide certificate status, so browsers don’t check directly.

Explain how to enable OCSP stapling in nginx and why it is useful.

Think about what directives you add in the server block and the benefit to users.

Describe the files nginx needs to support OCSP stapling and their roles.

Consider what nginx needs to prove the certificate is valid and trusted.