Skip to main content

How to Enable OCSP Stapling on Apache and Nginx?

As mentioned in the article What is OCSP Stapling, OCSP Stapling is designed to improve SSL negotiation performance while protecting visitor privacy. So how do you enable OCSP Stapling? This tutorial will explain how to enable OCSP Stapling on Apache and Nginx servers.

HowToSetIPSSL

Check your server version​

Please check your server version before you start. OCSP Stapling is supported on the following server versions:

  • Apache HTTP Server version 2.3.3 and later
  • Nginx version 1.3.7 and later

Use the following commands to check the version of the running server:

Apache：apache2 –v
Nginx：nginx -v

Configure OCSP Stapling​

Configuring OCSP Stapling on an Apache server

  1. Modify the SSL virtual host configuration file for the site

Add the following directives to the relevant lines to enable OCSP;

SSLUseStapling on

Add the following names outside the line,

SSLStaplingCache shmcb:/tmp/stapling_cache(128000)

For example:

SSLStaplingCache shmcb:/tmp/stapling_cache(128000)

SSLEngine on
SSLProtocol all -SSLv3 -SSLv2

SSLCertificateFile /path/to/your_domain_name.crt
SSLCertificateKeyFile /path/to/your_private.key
SSLCertificateChainFile /path/to/DigiCertCA.crt

SSLUseStapling on
  1. Run the following command to check whether there is any configuration error;
Apachectl –t
  1. Reload the Apache service;
service apache2 reload
  1. After the configuration is complete, save and exit, then restart Apache.

Configure OCSP Stapling on an Nginx Server​

The prerequisite for enabling OCSP Stapling in Nginx is that the SSL certificate is deployed first and accessible properly.

  1. Edit the site's SSL certificate configuration file

Add the following directives within the "server " block.

ssl_stapling on;
ssl_stapling_verify on;

For example:

server

{
listen 443 ssl;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

ssl_certificate /etc/ssl/bundle.crt;
ssl_certificate_key /etc/ssl/your_domain_name.key;

ssl_stapling on;
ssl_stapling_verify on;
}
  1. Run the following command to check if there are any configuration errors;
nginx –t
  1. After the configuration is complete, restart Nginx.
systemctl restart nginx

Test Whether OCSP Stapling Is Successfully Enabled​

This article uses two methods to test whether OCSP Stapling is successfully enabled.

Method 1: Use the OpenSSL command.​

Enter the following command:

openssl.exe s_client -connect www.domainame.com:443 -status

Replace www.domainame.com with your domain name.

If OCSP Stapling has been successfully enabled for the site, the returned prompt will include: OCSP Response Status: successful (0x0)

If no information is returned after execution, the enabling has failed.

Method 2: Check your website domain using a tool​

Check address: SSL Certificate Check

Enter your domain name and port 443, then click to run the check. In the certificate information, if the OCSP Stapling status shows: Supported, it means OCSP Stapling is successfully enabled. If it shows: Not supported, it means the enabling has failed.

That covers the full guide on how to enable OCSP Stapling in Apache and Nginx. If you have any questions during configuration, feel free to contact our official customer service, and we will serve you wholeheartedly!

Last updated on