What is SSL stapling Nginx?

OCSP stapling is a TLS/SSL extension which aims to improve the performance of SSL negotiation while maintaining visitor privacy. Before going ahead with the configuration, a short brief on how certificate revocation works.

How do I enable OCSP stapling in nginx?

Use the following instruction to enable OCSP stapling on your Nginx server after verifying that it supports OSCP stapling and can connect to the OCSP server.

1. Edit your site’s SSL configuration file.
2. (Optional) Add a DNS resolver for stapling.
3. Check the configuration for errors with Ngnix.
4. Reload the Nginx.

Should I use OCSP stapling?

Why you should use OCSP stapling OCSP stapling means providing website visitors with better security at faster speeds. Users experience faster load times on encrypted content due to no direct connections between the web browser and CA. This is especially important for high-traffic websites.

How do I set up OCSP stapling?

Configure your Apache server to use OCSP Stapling.

1. Edit your site’s VirtualHost SSL configuration. Add the following line INSIDE the block: SSLUseStapling on.
2. Check the configuration for errors with the Apache Control service. Apachectl -t.
3. Reload the Apache service. service apache2 reload.

What is CRL and OCSP?

Certificate Revocation List (CRL) – A CRL is a list of revoked certificates that is downloaded from the Certificate Authority (CA). Online Certificate Status Protocol (OCSP) – OCSP is a protocol for checking revocation of a single certificate interactively using an online service called an OCSP responder.

How do you know if OCSP is working?

in the opened dialog box switch radiobutton to OCSP and click Verify. This will return Verified if OCSP is working and certificate is ok. Also you can use ‘certutil -verify -urlfetch’ command to validate certificate and certificate chain. During this test certutil will check certificate revocation status through OCSP.

What occurs when a certificate is stapled?

OCSP stapling is a technique to get revocation information to browsers that fixes some of the performance and privacy issues associated with live OCSP fetching. In OCSP stapling, the server includes a current OCSP response for the certificate included (or “stapled”) into the initial HTTPS connection.

Does Nginx support OCSP stapling?

Depending on which version of Nginx you are using, you may need to modify these instructions accordingly. Nginx supports OCSP stapling in 1.3.7+. To see which version of Nginx you are running, use following command: Check if OCSP stapling is enabled.

How to troubleshoot SSL certificate errors in Nginx?

Do a configtest to see if everything is correct. Then reload the nginx service. Access the website on IE (on Vista and above) or Firefox 26+ and check the error log. If the file defined in ssl_trusted_certificate is missing a certificate an error similar to the following is displayed:

Where can I find the ciphers used by Nginx?

The ciphers are specified in the format understood by the OpenSSL library, for example: The full list can be viewed using the “ openssl ciphers ” command. The previous versions of nginx used different ciphers by default.

Is OCSP stapling enabled under SSL certificate?

If OCSP stapling is enabled, under SSL Certificate has not been revoked, to the right of OCSP Staple, it says Good .