Contents
How do I enable OCSP stapling?
Configure your Apache server to use OCSP Stapling.
- Edit your site’s VirtualHost SSL configuration. Add the following line INSIDE the block: SSLUseStapling on.
- Check the configuration for errors with the Apache Control service. Apachectl -t.
- Reload the Apache service. service apache2 reload.
How do I know if my stapling OCSP is working?
Check if OCSP stapling is enabled. Go to https://www.digicert.com/help and in the Server Address box, type in your server address (i.e. www.digicert.com). If OCSP stapling is enabled, under SSL Certificate has not been revoked, to the right of OCSP Staple, it says Good.
Is OCSP stapling necessary?
This feature is a step towards enabling an important security feature on the web: certificate revocation checking. Reliable OCSP stapling also improves connection times by up to 30% in some cases.
How does OCSP stapling work?
How OCSP stapling works. OCSP stapling is a more efficient way to handle the verification of certificate information. When a user attempts to visit the site, the digitally time-stamped response is then “stapled” with the TLS/SSL handshake via the Certificate Status Request extension response.
What is the OCSP protocol used for?
OCSP is a Hypertext Transfer Protocol (HTTP) used for obtaining the revocation status of an X. 509 digital certificate. It was created as an alternative to Certificate Revocation Lists (CRLs).
Does Chrome use OCSP stapling?
Chrome supports OCSP stapling on Windows, Linux, and ChromeOS.
Does Chrome use CRL?
With an increased number of revocations, there’s the potential that OCSP/CRL responses may start to take a little longer as the Certificate Authorities load up their lists. Whilst Google Chrome does have a form of certificate revocation check, it’s not what you might expect.
How to enable OCSP stapling on one server block?
Note: If you need to enable OCSP stapling on just one server block, it must be the “default_server”. If you need to enable it on several server blocks, it must be enabled on the ‘default_server’ first. Then it can be enabled on any other server block.
Which is version of Apache supports OCSP stapling?
Apache supports OCSP stapling in Apache HTTPD Server 2.3.3+. To see which version of Apache you are running, use one of the following commands: apache2 -v
What kind of Nginx is needed for OCSP stapling?
nginx You need nginx 1.3.7 or higher for OCSP stapling. In order to validate OCSP responses before stapling them, nginx requires you to provide it with a file containing your certificate’s entire intermediate certificate chain, including the root certificate. If you use SSLMate to manage your certificates, you can create this file as follows:
Is it OK to omit the resolver in OCSP?
Omitting the resolver is not recommended, since it would cause OCSP stapling to stop working if the OCSP responder’s IP address changed. Also note that this configuration requires you to set the ssl_trusted_certificate option. This may conflict with the configuration for client certificates.