OCSP Stapling is a technology that optimizes HTTPS handshake, allowing servers to actively provide certificate revocation status information during TLS handshake, avoiding clients requesting CA's OCSP servers individually. 1. It speeds up page loading, reduces CA pressure, and improves security; 2. Enable in Nginx to ensure that the certificate supports OCSP, the certificate chain is complete, and Nginx supports OpenSSL; 3. Specific steps include merging certificate chain files, configuring ssl_certificate, turning on ssl_stapling and ssl_stapling_verify, and setting up DNS resolvers; 4. Common problems include client not supporting, certificates without OCSP address, DNS or firewall restrictions, and certificate chain incomplete; 5. You can verify that the enabled is successful through SSL Labs test, and some CDNs have been supported by default.

OCSP Stapling is a technology used to accelerate the HTTPS handshake process. It allows the server to actively provide verification information on the certificate revocation status to the client during the TLS handshake without the need for the client to contact the certificate authority (CA) for online inquiries.

This has several benefits: it speeds up page loading, reduces pressure on the CA server, and also improves security. Because in the traditional way, if the client cannot access the OCSP server, it may cause the connection failure or downgrade risk.

What is OCSP Stapling?

OCSP (Online Certificate Status Protocol) is a mechanism used to check whether an SSL/TLS certificate has been revoked. Without OCSP Stapling, the browser will access the OCSP address provided by the CA to confirm the certificate status by itself, which will cause additional delay.

After enabling OCSP Stapling, the server will actively obtain the OCSP response instead of the browser, and "post" it" in its own response to send it to the client during the TLS handshake. In this way, the client no longer needs to request the OCSP server separately, saving a network round trip.

This feature is part of the TLS protocol and can take effect as long as both the client and the server support it.

How to enable OCSP Stapling in Nginx?

To enable OCSP Stapling on Nginx, you need the following prerequisites:

• Your SSL certificate must support OCSP.
• You must have a complete certificate chain (including intermediate certificates).
• Nginx must be compiled to support OpenSSL and have a newer version (1.3.7 or higher or better).

Here are the specific steps:

• Make sure your certificate chain is complete. Merge your domain certificate and intermediate certificate into a file, such as fullchain.pem .
• Set ssl_certificate in Nginx configuration to point to this complete certificate chain file.
• Add the following configuration items to your server block:

 ssl_stapling on;
ssl_stapling_verify on;
resolver 8.8.8.8 8.8.4.4 valid=300s;
resolver_timeout 5s;

in:

• ssl_stapling on; means to enable OCSP Stapling.
• ssl_stapling_verify on; indicates that the validity of the OCSP response is required.
• resolver sets the DNS resolver address, which Nginx uses to resolve the OCSP address. It is recommended to use public DNS like Google's 8.8.8.8.8.
• resolver_timeout controls the DNS query timeout time.

Frequently Asked Questions and Precautions

Sometimes you will find that OCSP Stapling is not actually effective, and possible reasons include:

• The client does not support it (such as some older browsers).
• The certificate itself does not contain OCSP address information.
• Nginx cannot access the OCSP server, which may be a firewall or DNS problem.
• The complete certificate chain is not configured correctly.

If you are not sure if it is enabled successfully, you can test your site using online tools such as SSL Labs to see if "OCSP stapling" appears as supported.

In addition, some CDN services (such as Cloudflare) have enabled OCSP Stapling by default, so you don't need to configure it manually.

Basically that's it. OCSP Stapling is not complicated but is easy to ignore, especially in the pursuit of website performance and security, it is worth taking a few minutes to configure.

The above is the detailed content of What is OCSP Stapling and how to enable it in Nginx?. For more information, please follow other related articles on the PHP Chinese website!