Skip to main content

How to Enable OCSP Stapling in Apache and Nginx?

In the article "What Is OCSP Stapling," it was mentioned that OCSP Stapling is designed to improve the performance of SSL negotiation while maintaining visitor privacy. So how do you enable the OCSP Stapling service? This tutorial will introduce how to enable OCSP Stapling on Apache and Nginx servers.

HowToSetIPSSL

Check the Server Version​

Please check your server version before starting. Only the following server versions support OCSP Stapling:

  • Apache HTTP Server version 2.3.3 and above
  • Nginx version 1.3.7 and above

Use the following command to check the running server version:

Apache：apache2 –v
Nginx：nginx -v

Configure OCSP Stapling​

Configure OCSP Stapling on the Apache server

  1. Modify the site's SSL virtual host configuration file

Add the following directives to the lines to enable OCSP;

SSLUseStapling on

Add the following name outside the line,

SSLStaplingCache shmcb:/tmp/stapling_cache(128000)

For example:

SSLStaplingCache shmcb:/tmp/stapling_cache(128000)

SSLEngine on
SSLProtocol all -SSLv3 -SSLv2

SSLCertificateFile /path/to/your_domain_name.crt
SSLCertificateKeyFile /path/to/your_private.key
SSLCertificateChainFile /path/to/DigiCertCA.crt

SSLUseStapling on
  1. Run the following command to check whether the configuration is correct;
Apachectl –t
  1. Reload the Apache service;
service apache2 reload
  1. Configuration is complete. Save, exit, and restart Apache.

Configuring OCSP Stapling on an Nginx Server​

Before enabling OCSP Stapling on Nginx, you must first deploy the SSL certificate and ensure it is accessible.

  1. Edit the site's SSL certificate configuration file

Add the following directives inside the “server ” block.

ssl_stapling on;
ssl_stapling_verify on;

For example:

server

{
listen 443 ssl;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

ssl_certificate /etc/ssl/bundle.crt;
ssl_certificate_key /etc/ssl/your_domain_name.key;

ssl_stapling on;
ssl_stapling_verify on;
}
  1. Run the following command to check whether the configuration is correct;
nginx –t
  1. After the configuration is complete, restart Nginx.
systemctl restart nginx

Test Whether OCSP Stapling Is Successfully Enabled​

This article uses two methods to test whether OCSP Stapling is successfully enabled.

Method 1: Use the OpenSSL command.​

Enter the command as follows:

openssl.exe s_client -connect www.domainame.com:443 -status

Replace www.domainame.com with your domain name.

If OCSP Stapling has been successfully enabled on the site, the returned message will include: OCSP Response Status: successful (0x0)

If no information is returned after running the command, the enablement has failed.

Method 2: Use a tool to check the website domain​

Check address: SSL Certificate Check

Enter the domain name, use port 443, and click to run the check. In the certificate information, if the OCSP Stapling status shows: Supported, it means the feature has been successfully enabled. If it shows: Not Supported, it means the enablement has failed.

The above is all the content on how to enable OCSP Stapling in Apache and Nginx. If you have any questions during configuration, please feel free to contact our official customer support. We are happy to help!

Last updated on