# OCSP stapling for client certificates

**URL:** <https://www.ruby-forum.com/t/ocsp-stapling-for-client-certificates/231745>\
**Category:** NGINX\
**Created:** [August 27, 2014, 6:51pm UTC](https://www.ruby-forum.com/t/ocsp-stapling-for-client-certificates/231745 "2014-08-27T18:51:49Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![addis\_a](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/c4cdca/32.png) [@addis\_a](https://www.ruby-forum.com/u/addis_a)\
**Post date:** [August 27, 2014, 6:51pm UTC](https://www.ruby-forum.com/t/ocsp-stapling-for-client-certificates/231745/1 "2014-08-27T18:51:49Z")

</div>

Hi,

I was able to setup nignx with client certificate authentication and  
OCSP  
stapling. I however noticed that OCSP is used only for the nginx server  
ssl  
certificate.

It does not use OCSP for validating client certificates to see if a  
client  
is using a revoked certificate or not. Is ssl\_crl the only way to  
checked  
for revoked client certificates or can nginx be configured to use OCSP  
for  
client certificates ?

Thanks.

---

<div class="post-metadata">

**Author:** ![Mohammad\_Dhedhi](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/b782af/32.png) [@Mohammad\_Dhedhi](https://www.ruby-forum.com/u/Mohammad_Dhedhi)\
**Post date:** [August 27, 2014, 6:56pm UTC](https://www.ruby-forum.com/t/ocsp-stapling-for-client-certificates/231745/2 "2014-08-27T18:56:42Z")

</div>

Hello!

On Wed, Aug 27, 2014 at 11:51:08AM -0500, Mohammad Dhedhi wrote:

> Hi,
> 
> I was able to setup nignx with client certificate authentication and OCSP  
> stapling. I however noticed that OCSP is used only for the nginx server ssl  
> certificate.
> 
> It does not use OCSP for validating client certificates to see if a client  
> is using a revoked certificate or not. Is ssl\_crl the only way to checked  
> for revoked client certificates or can nginx be configured to use OCSP for  
> client certificates ?

No, nginx doesn’t support OCSP-based validation of client  
certificates, it only supports OCSP stapling. If you want to  
check revocation of client certificates, the only available option  
is to use ssl\_crl.

–  
Maxim D.

> **[nginx](http://nginx.org/)**

---

<div class="post-metadata">

**Author:** ![Mohammad\_Dhedhi](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/b782af/32.png) [@Mohammad\_Dhedhi](https://www.ruby-forum.com/u/Mohammad_Dhedhi)\
**Post date:** [June 28, 2015, 6:20pm UTC](https://www.ruby-forum.com/t/ocsp-stapling-for-client-certificates/231745/3 "2015-06-28T18:20:31Z")

</div>

Hi,

Actually, I had the same questions.  
Is this something that’s available by now, or is it in the pipeline of  
any  
new release of Nginx or will it never be?

I’m just asking since I believe this might be a good feature to add  
since  
CRL’s could get very big when lots of certificate have been revoked, and  
since it is not a realtime updating mechanism.

By using a OCSP, there is a little overhead of contacting the OCSP for  
checking each client certificate that is being validated…  
I believe this to be much more efficient than regularly  
downloading/uploading a CRL and reloading Nginx. This process can fail  
on  
multiple locations which makes it harder to track and a big disadvantage  
of  
the CRL’s is that they are not realtime updated, which is the case for  
OCSP’s.  
This way revoking a certificate will cause it to immediately retract the  
access to client certificate secured applications (for all new  
sessions).

Is it already supported in some version of Nginx or is it planned  
somewhere  
in the future?

Many thanks,  
Kind regards,

Francis Claessens.

Posted at Nginx Forum:

> **[Re: OCSP stapling for client certificates](https://forum.nginx.org/read.php?2,252893,259954#msg-259954)**
>
> Hi, I was able to setup nignx with client certificate authentication and OCSP stapling. I however noticed that OCSP is used only for the nginx server ssl certificate. It does not use OCSP for validating client certificates to see if a client is using...

---

<div class="post-metadata">

**Author:** ![Mohammad\_Dhedhi](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/b782af/32.png) [@Mohammad\_Dhedhi](https://www.ruby-forum.com/u/Mohammad_Dhedhi)\
**Post date:** [July 6, 2015, 1:44am UTC](https://www.ruby-forum.com/t/ocsp-stapling-for-client-certificates/231745/4 "2015-07-06T01:44:20Z")

</div>

Hello!

On Sun, Jun 28, 2015 at 12:20:06PM -0400, prozit wrote:

> I believe this to be much more efficient than regularly  
> downloading/uploading a CRL and reloading Nginx. This process can fail on  
> multiple locations which makes it harder to track and a big disadvantage of  
> the CRL’s is that they are not realtime updated, which is the case for  
> OCSP’s.  
> This way revoking a certificate will cause it to immediately retract the  
> access to client certificate secured applications (for all new sessions).
> 
> Is it already supported in some version of Nginx or is it planned somewhere  
> in the future?

As of now, there are no plans to support OCSP-based validation of  
client certificates.

–  
Maxim D.

> **[nginx](http://nginx.org/)**