# Differing ocsp responses

**URL:** <https://www.ruby-forum.com/t/differing-ocsp-responses/244862>\
**Category:** NGINX\
**Created:** [June 29, 2016, 5:55am UTC](https://www.ruby-forum.com/t/differing-ocsp-responses/244862 "2016-06-29T05:55:00Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sadaf\_N](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/858c86/32.png) [@Sadaf\_N](https://www.ruby-forum.com/u/Sadaf_N)\
**Post date:** [June 29, 2016, 5:55am UTC](https://www.ruby-forum.com/t/differing-ocsp-responses/244862/1 "2016-06-29T05:55:00Z")

</div>

I think I’ve got ocsp stapling setup correctly with Nginx (1.9.0). I am  
seeing valid OCSP responses however if I keep querying the same server I  
also frequently see “No response”. The OCSP responses are valid for  
seven  
days. Is each worker doing its own OCSP query independently of the  
others?  
Or is there something else happening?

---

<div class="post-metadata">

**Author:** ![CJ\_Ess](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/c68b51/32.png) [@CJ\_Ess](https://www.ruby-forum.com/u/CJ_Ess)\
**Post date:** [June 29, 2016, 7:23am UTC](https://www.ruby-forum.com/t/differing-ocsp-responses/244862/2 "2016-06-29T07:23:47Z")

</div>

Hello,

Nginx uses a per worker OCSP cache.

---

<div class="post-metadata">

**Author:** ![CJ\_Ess](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/c68b51/32.png) [@CJ\_Ess](https://www.ruby-forum.com/u/CJ_Ess)\
**Post date:** [June 29, 2016, 5:17pm UTC](https://www.ruby-forum.com/t/differing-ocsp-responses/244862/3 "2016-06-29T17:17:53Z")

</div>

Ok, that explains it then. Does the cache survive reloads? Or does it  
need  
to requery?

On Wed, Jun 29, 2016 at 1:23 AM, Kurt C. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)

---

<div class="post-metadata">

**Author:** ![CJ\_Ess](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/c68b51/32.png) [@CJ\_Ess](https://www.ruby-forum.com/u/CJ_Ess)\
**Post date:** [June 29, 2016, 7:07pm UTC](https://www.ruby-forum.com/t/differing-ocsp-responses/244862/4 "2016-06-29T19:07:43Z")

</div>

## nginx workers are recreated on reload (read [Controlling nginx](http://nginx.org/en/docs/control.html#reconfiguration)), nothing can thus remains from past cache at this level.

_B. R._

On Wed, Jun 29, 2016 at 6:26 PM, itpp2012 [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)

---

<div class="post-metadata">

**Author:** ![CJ\_Ess](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/c68b51/32.png) [@CJ\_Ess](https://www.ruby-forum.com/u/CJ_Ess)\
**Post date:** [June 29, 2016, 6:27pm UTC](https://www.ruby-forum.com/t/differing-ocsp-responses/244862/5 "2016-06-29T18:27:24Z")

</div>

## CJ Ess Wrote:

> Ok, that explains it then. Does the cache survive reloads? Or does it  
> need  
> to requery?

See also [https://forum.nginx.org/read.php?2,249249,249249#msg-249249](https://forum.nginx.org/read.php?2,249249,249249#msg-249249)

"When Nginx starts for the first time, and there’s no cached OCSP  
response,  
the first client to try an OCSP will fail; I understand that this is by  
design, and I’ve overcome it by simply ‘warming’ the cached manually by  
using OpenSSL’s s\_client… "

Posted at Nginx Forum:  
[https://forum.nginx.org/read.php?2,267945,267953#msg-267953](https://forum.nginx.org/read.php?2,267945,267953#msg-267953)