OCSP Stapling improves both performance and privacy for SSL certificate validation — letting your server proactively provide certificate revocation status rather than requiring each visitor's browser to check separately.
What OCSP Does
Online Certificate Status Protocol lets a browser verify a certificate hasn't been revoked since issuance — without stapling, this means every visitor's browser makes a separate request to the Certificate Authority's OCSP server on every visit.
The Problem OCSP Stapling Solves
- Performance — each visitor's browser making a separate OCSP request adds latency to page load
- Privacy — without stapling, the CA's OCSP server can see which sites individual visitors are checking certificates for
- Reliability — if the CA's OCSP server is slow or unreachable, browsers may hang or behave inconsistently
How Stapling Fixes This
With OCSP stapling enabled, your server periodically fetches the OCSP response itself and includes ("staples") it directly in the TLS handshake with visitors — eliminating the need for each individual browser to make a separate request.
Enabling OCSP Stapling in Nginx
server {
listen 443 ssl;
server_name yourdomain.com;
ssl_certificate /etc/letsencrypt/live/yourdomain.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/yourdomain.com/privkey.pem;
ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /etc/letsencrypt/live/yourdomain.com/chain.pem;
resolver 8.8.8.8 8.8.4.4 valid=300s;
}ssl_trusted_certificate should point to the CA's chain certificate (not your own certificate), and resolver specifies DNS servers Nginx uses to reach the OCSP responder.
Enabling OCSP Stapling in Apache
<VirtualHost *:443>
SSLUseStapling on
SSLStaplingCache "shmcb:/var/run/ocsp(128000)"
</VirtualHost>SSLStaplingResponderTimeout 5
SSLStaplingReturnResponderErrors offTesting Whether Stapling Is Working
echo | openssl s_client -connect yourdomain.com:443 -status 2>/dev/null | grep -A 5 "OCSP Response"A successful response shows "OCSP Response Status: successful" — if stapling isn't working, this section will be absent or show an error.
Reloading After Configuration
sudo nginx -t && sudo systemctl reload nginxDoes Every Certificate Support Stapling?
Most modern certificates from established CAs support OCSP, making stapling available — verify your specific certificate's issuing CA provides OCSP responses if stapling doesn't appear to work despite correct configuration.
Common Errors
Stapling configured but no response returned — verify the resolver directive is correctly set (Nginx needs to resolve the OCSP responder's hostname), and that outbound connectivity to the CA's OCSP server isn't blocked by a firewall.
"ssl_trusted_certificate" pointing to the wrong file — this should be the CA's intermediate/chain certificate, not your site's own leaf certificate; a common configuration mix-up.
Continue Reading
- Understanding Certificate Chains and Intermediate Certificates
- TLS 1.2 vs TLS 1.3: Understanding and Configuring Modern TLS on Nginx & Apache
- How to Test Your SSL/TLS Configuration for Security Issues
Browse more articles in SSL/TLS & Certificates.
