OCSP stapling in Nginx - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to enable OCSP stapling in the nginx server block.

Nginx

ssl_stapling [1];

Drag options to blanks, or click blank then click option'

Aon

Benable

Coff

Dtrue

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'off' disables stapling.

Using 'enable' or 'true' are not valid nginx directive values.

Setting ssl_stapling on; enables OCSP stapling in nginx.

2fill in blank

medium

Complete the code to specify the trusted certificate for OCSP stapling.

Nginx

ssl_trusted_certificate [1];

Drag options to blanks, or click blank then click option'

A/etc/ssl/certs/ca-bundle.crt

B/var/log/nginx/access.log

C/etc/nginx/ssl/server.crt

D/etc/nginx/ssl/server.key

Attempts:

3 left

💡 Hint

Common Mistakes

Using the server private key or certificate instead of the CA bundle.

Using log file paths.

The ssl_trusted_certificate directive must point to the CA bundle file that nginx uses to verify OCSP responses.

3fill in blank

hard

Fix the error in the directive to enable OCSP stapling with verification.

Nginx

ssl_stapling_verify [1];

Drag options to blanks, or click blank then click option'

Afalse

Boff

Con

Ddisable

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'off' disables verification.

Using 'disable' or 'false' are invalid values.

To enable OCSP stapling verification, use ssl_stapling_verify on;.

4fill in blank

hard

Fill both blanks to complete the OCSP stapling configuration in nginx.

Nginx

ssl_stapling [1];
ssl_stapling_verify [2];

Drag options to blanks, or click blank then click option'

Aon

Boff

Cdisable

Dtrue

Attempts:

3 left

💡 Hint

Common Mistakes

Turning off stapling disables the feature.

Using invalid values like 'disable' or 'true'.

Enable OCSP stapling with ssl_stapling on; and disable verification with ssl_stapling_verify off;.

5fill in blank

hard

Fill all three blanks to complete the nginx server block snippet for OCSP stapling.

Nginx

server {
    listen 443 ssl;
    ssl_certificate [1];
    ssl_certificate_key [2];
    ssl_trusted_certificate [3];
    ssl_stapling on;
    ssl_stapling_verify on;
}

Drag options to blanks, or click blank then click option'

A/etc/nginx/ssl/server.crt

B/etc/nginx/ssl/server.key

C/etc/ssl/certs/ca-bundle.crt

D/var/www/html/index.html

Attempts:

3 left

💡 Hint

Common Mistakes

Mixing up certificate and key file paths.

Using unrelated file paths like web root files.

The ssl_certificate and ssl_certificate_key directives specify your server's certificate and private key. The ssl_trusted_certificate points to the CA bundle for OCSP verification.

Practice

1. What is the main purpose of enabling OCSP stapling in nginx?

easy

A. To encrypt the website traffic with a stronger cipher

B. To block unauthorized IP addresses automatically

C. To speed up HTTPS by caching the certificate status

D. To compress website content for faster loading

Solution

1. Step 1: Understand OCSP stapling concept

   OCSP stapling allows the server to cache the certificate status from the certificate authority, reducing the need for clients to query it directly.

2. Step 2: Identify the main benefit in nginx

   This caching speeds up HTTPS connections by reducing latency and improving performance.

3. Final Answer:

   To speed up HTTPS by caching the certificate status -> Option C

4. Quick Check:

   OCSP stapling = speed up HTTPS [OK]

Hint: OCSP stapling caches cert status to speed HTTPS [OK]

Common Mistakes:

• Confusing OCSP stapling with encryption methods
• Thinking it blocks IP addresses
• Assuming it compresses website content

2. Which of the following is the correct nginx directive to enable OCSP stapling?

easy

A. ssl_ocsp on;

B. ssl_stapling_enable true;

C. ssl_ocsp_stapling enable;

D. ssl_stapling on;

Solution

1. Step 1: Recall nginx directive syntax for OCSP stapling

   The correct directive to enable OCSP stapling in nginx is ssl_stapling on;.

2. Step 2: Check each option for syntax correctness

   Options A, B, and C use incorrect directive names or syntax.

3. Final Answer:

   ssl_stapling on; -> Option D

4. Quick Check:

   Enable OCSP stapling with ssl_stapling on; [OK]

Hint: Use ssl_stapling on; to enable OCSP stapling [OK]

Common Mistakes:

• Using incorrect directive names like ssl_ocsp
• Adding extra words like _enable or enable
• Using true/false instead of on/off

3. Given this nginx snippet, what will happen if ssl_stapling is enabled but resolver is not set?

server {
  listen 443 ssl;
  ssl_certificate /etc/ssl/cert.pem;
  ssl_certificate_key /etc/ssl/key.pem;
  ssl_stapling on;
}

medium

A. nginx will log errors but continue running without stapling

B. nginx will fail to start due to missing resolver

C. OCSP stapling will be disabled silently

D. OCSP stapling will work normally without issues

Solution

1. Step 1: Understand resolver role in OCSP stapling

   nginx needs a DNS resolver configured to fetch OCSP responses from the certificate authority.

2. Step 2: Analyze behavior without resolver

   If no resolver is set, nginx cannot fetch OCSP responses, so it logs errors but continues running without stapling.

3. Final Answer:

   nginx will log errors but continue running without stapling -> Option A

4. Quick Check:

   Missing resolver = errors logged, no stapling [OK]

Hint: Missing resolver logs errors, disables stapling silently [OK]

Common Mistakes:

• Assuming nginx fails to start
• Thinking stapling works without resolver
• Believing stapling disables silently without logs

4. You enabled ssl_stapling on; and set a resolver, but nginx still does not staple OCSP responses. What is the most likely cause?

medium

A. The SSL certificate does not include the OCSP responder URL

B. The ssl_certificate_key file is missing

C. The server is listening on port 80 instead of 443

D. The ssl_protocols directive is missing

Solution

1. Step 1: Check prerequisites for OCSP stapling

   OCSP stapling requires the SSL certificate to include an OCSP responder URL to fetch status.

2. Step 2: Identify why stapling fails despite correct config

   If the certificate lacks the OCSP responder URL, nginx cannot get the status, so stapling fails.

3. Final Answer:

   The SSL certificate does not include the OCSP responder URL -> Option A

4. Quick Check:

   Missing OCSP URL in cert = stapling fails [OK]

Hint: Cert must have OCSP URL for stapling to work [OK]

Common Mistakes:

• Thinking missing key file causes stapling failure
• Confusing HTTP port with SSL port
• Assuming ssl_protocols affects stapling directly

5. You want to enable OCSP stapling in nginx with these requirements: - Use Google's public DNS resolver - Enable stapling - Ensure nginx reloads config safely Which configuration snippet correctly achieves this?

server {
  listen 443 ssl;
  ssl_certificate /etc/ssl/cert.pem;
  ssl_certificate_key /etc/ssl/key.pem;
  # Your config here
}

hard

A. resolver 8.8.8.8;
ssl_stapling off;
ssl_stapling_verify on;

B. resolver 8.8.8.8 8.8.4.4 valid=300s;
ssl_stapling on;
ssl_stapling_verify on;

C. ssl_stapling on;
ssl_stapling_verify off;
resolver 1.1.1.1;

D. resolver 8.8.8.8 8.8.4.4;
ssl_stapling on;
ssl_stapling_verify off;

Solution

1. Step 1: Set resolver with Google's DNS and validity

   Use resolver 8.8.8.8 8.8.4.4 valid=300s; to specify DNS servers and cache time.

2. Step 2: Enable OCSP stapling and verification

   Set ssl_stapling on; and ssl_stapling_verify on; to enable stapling and verify OCSP responses.

3. Step 3: Confirm safe reload

   After config changes, run nginx -t to test and nginx -s reload to reload safely.

4. Final Answer:

   resolver 8.8.8.8 8.8.4.4 valid=300s; ssl_stapling on; ssl_stapling_verify on; -> Option B

5. Quick Check:

   Correct resolver + stapling on + verify on = resolver 8.8.8.8 8.8.4.4 valid=300s; ssl_stapling on; ssl_stapling_verify on; [OK]

Hint: Use resolver with valid=, enable stapling and verify on [OK]

Common Mistakes:

• Forgetting ssl_stapling_verify on
• Using only one resolver without valid time
• Disabling stapling or verification accidentally