How is OCSP stapled implemented?
Configure your Apache server to use OCSP Stapling.
- Edit your site’s VirtualHost SSL configuration. Add the following line INSIDE the block: SSLUseStapling on.
- Check the configuration for errors with the Apache Control service. Apachectl -t.
- Reload the Apache service. service apache2 reload.
How does OCSP work?
How does OCSP Work? When a user requests the validity of a certificate, an OCSP request is sent to an OCSP Responder. This checks the specific certificate with a trusted certificate authority and an OCSP response is sent back with a response of either ‘good’, ‘revoked’ or ‘unknown’.
How does OCSP stapling work for SSL certificates?
OCSP stapling allows a web server to obtain a digitally signed and time-stamped OCSP response from the OCSP responder operated by the CA that issued the server certificate. The OCSP responder gives a ‘valid’ or ‘revoked’ status to the web browser, communicating to the browser about the validity status of the SSL certificate.
How does OCSP take a toll on the performance?
OCSP, on the other hand, doesn’t take a toll on the performance as the webserver (not a web browser) is supposed to download a copy of the OCSP response from the OCSP responder. The web browser simply has to download this copy from the webserver.
How does the Certificate Status Protocol ( OSCP ) work?
It was created as an alternative to Certificate Revocation Lists (CRLs). With OSCP, a relying party is able to submit a certificate status request to an OCSP responder, such as a Certification Authority (CA). This returns an authentic, digitally signed response indicating the certificate status.
What is the OCSP response status if it is not enabled?
If OCSP is enabled, you’ll receive the following response in the OCSP Response Data section: OCSP Response Status: successful (0x0). If OCSP is not enabled, you will not see any OCSP response data. In this case, make sure your intermediate certificate is installed correctly.