# Ocsp stapling

**URL:** <https://www.ruby-forum.com/t/ocsp-stapling/243107>\
**Category:** NGINX\
**Created:** [August 22, 2015, 4:41am UTC](https://www.ruby-forum.com/t/ocsp-stapling/243107 "2015-08-22T04:41:41Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Rafa\_F](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/958977/32.png) [@Rafa\_F](https://www.ruby-forum.com/u/Rafa_F)\
**Post date:** [August 22, 2015, 4:41am UTC](https://www.ruby-forum.com/t/ocsp-stapling/243107/1 "2015-08-22T04:41:41Z")

</div>

I have my nginx virtual host set to enable ocsp stapling but it doesn’t  
actually do it. Ssllabs testing reports no. OpenSSL cli testing reports  
nothing.

Nginx v1.8.0  
Centos 6.7 64bit  
OpenSSL 1.0.1e

I only have the ocsp config on one domain for testing. Any thoughts?  
Thanks.

–

Fabe

---

<div class="post-metadata">

**Author:** ![Fabian\_Santiago](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/7c8e57/32.png) [@Fabian\_Santiago](https://www.ruby-forum.com/u/Fabian_Santiago)\
**Post date:** [August 22, 2015, 8:35pm UTC](https://www.ruby-forum.com/t/ocsp-stapling/243107/2 "2015-08-22T20:35:37Z")

</div>

I have been using Nginx 1.8.X with ocsp stabling for a couple of weeks  
and  
it seems to be fine. Please send your config files, it may help…

Posted at Nginx Forum:

> **[Re: Ocsp stapling](https://forum.nginx.org/read.php?2,261177,261181#msg-261181)**
>
> I have my nginx virtual host set to enable ocsp stapling but it doesn't actually do it. Ssllabs testing reports no. OpenSSL cli testing reports nothing. Nginx v1.8.0 Centos 6.7 64bit OpenSSL 1.0.1e I only have the ocsp config on one domain for...

---

<div class="post-metadata">

**Author:** ![Fabian\_Santiago](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/7c8e57/32.png) [@Fabian\_Santiago](https://www.ruby-forum.com/u/Fabian_Santiago)\
**Post date:** [August 22, 2015, 8:47pm UTC](https://www.ruby-forum.com/t/ocsp-stapling/243107/3 "2015-08-22T20:47:18Z")

</div>

Sure,

here is the relevant portion of my virtual hosts config:

server {  
listen 443 ssl;  
server\_name ;

client\_max\_body\_size 64m;  
client\_body\_timeout 60;

access\_log /var/log/nginx/…;  
error\_log /var/log/nginx/…;

root /var/www/html/rc/;  
index index.html index.php;

ssl\_protocols TLSv1.1 TLSv1.2;  
ssl\_certificate /etc/pki/tls/private/…pem;  
ssl\_certificate\_key /etc/pki/tls/private/…pem;

ssl\_session\_cache shared:SSL:10m;  
ssl\_session\_timeout 4h;

ssl\_ciphers HIGH:!aNULL:!MD5;  
ssl\_prefer\_server\_ciphers on;  
ssl\_dhparam /etc/pki/tls/private/dhparams.pem;

add\_header Public-Key-Pins-Report-Only  
‘pin-sha256=“amMeV6gb9QNx0Zf7FtJ19Wa/t2B7KpCF/1n2Js3UuSU=”;  
pin-sha256=“hXVOamtUHc8T8jznu+VMpu6wgk3ASIUi6YM4obeAEDw=”;  
max-age=31536000; includeSubDomains’;

add\_header Strict-Transport-Security “max-age=31536000;  
includeSubdomains”;

resolver 127.0.0.1;  
ssl\_stapling on;  
ssl\_stapling\_verify on;  
ssl\_trusted\_certificate /etc/pki/tls/private/root\_store/…pem;

---

<div class="post-metadata">

**Author:** ![Fabian\_Santiago](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/7c8e57/32.png) [@Fabian\_Santiago](https://www.ruby-forum.com/u/Fabian_Santiago)\
**Post date:** [August 23, 2015, 10:01am UTC](https://www.ruby-forum.com/t/ocsp-stapling/243107/4 "2015-08-23T10:01:11Z")

</div>

Config files seems to be OK. Just make sure “ssl\_trusted\_certificate”  
contais the intermediate & root certificates (in that order from top to  
bottom).

You can test with the following command:

echo QUIT | openssl s\_client -connect [yourhost.com:443](http://yourhost.com:443) -status 2\>  
/dev/null  
| grep -A 17 ‘OCSP response:’ | grep -B 17 ‘Next Update’

good luck

Posted at Nginx Forum:

> **[Re: Ocsp stapling](https://forum.nginx.org/read.php?2,261177,261185#msg-261185)**
>
> I have my nginx virtual host set to enable ocsp stapling but it doesn't actually do it. Ssllabs testing reports no. OpenSSL cli testing reports nothing. Nginx v1.8.0 Centos 6.7 64bit OpenSSL 1.0.1e I only have the ocsp config on one domain for...

---

<div class="post-metadata">

**Author:** ![Fabian\_Santiago](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/7c8e57/32.png) [@Fabian\_Santiago](https://www.ruby-forum.com/u/Fabian_Santiago)\
**Post date:** [August 23, 2015, 10:31pm UTC](https://www.ruby-forum.com/t/ocsp-stapling/243107/5 "2015-08-23T22:31:50Z")

</div>

Update;

it all works now. once i enabled ocsp stapling for ALL of my virtual  
domains, they then all began reporting correct results.

- fabe

---

<div class="post-metadata">

**Author:** ![Fabian\_Santiago](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/7c8e57/32.png) [@Fabian\_Santiago](https://www.ruby-forum.com/u/Fabian_Santiago)\
**Post date:** [August 23, 2015, 3:56pm UTC](https://www.ruby-forum.com/t/ocsp-stapling/243107/6 "2015-08-23T15:56:21Z")

</div>

Thanks.

It does.

Test produces no results.

Not working on ssllabs (no result).

I’m clueless. I’ve seen mention out on the web about making sure you  
define ocsp for the default site or none else will work. I also make use  
of sni as I only have one ip address.

I have no truly “default” site configured.

Could be related? I am new to nginx so I’m still learning lots. Thanks  
again.

–

Fabe