Securing nginx configurations: implementing OCSP stapling

Securing nginx configurations

Implementing OCSP stapling in nginx

OCSP stapling is a logical follow-up on Online Certificate Status Protocol. OCSP itselfs just checks if certificate is still valid by determining if it is on a revocation list.

The original OCSP protocol forces the client to check for the status of a certificate. This results in a lot of traffic for the CA behind the certificate.

OCSP stapling moves the check to the owner of the certificate. On a regular basis the Nginx server will perform the check, receiving a new OCSP response. This response is stapled upon the SSL/TLS process with the user client. Due to this addition, OCSP stapling ensures the client that the owner is keeping their certificate up-to-date and is still valid.


All these snippets needs to be added below the virtual host. OCSP stapling is only useful when using SSL and is enabled (ssl on or listen <port> ssl).

Enable OCSP stapling and verification

# Turn on stapling

ssl_stapling on;


# Enable verification
ssl_stapling_verify on;


Define certificate for OCSP stapling

Next is defining a certificate. This step is optional when the full certificate chain was already provided with the ssl_certificate statement. In case just the certificate is being used (not the parts of your CA), then this statement is needed:

# Define chained certificate (optional if already defined with ssl_certificate).
ssl_trusted_certificate /etc/nginx/ssl/rootCA_plus_intermediates_chained.crt;

Define nginx resolving

To ensure proper resolving used when querying the verification systems, define what resolvers and their cache time. We use a low timeout, to quickly move to the next resolver if the first one fails.

# Define resolvers, with a cache time of 10 minutes.


# Next define timeout for resolving, to limit timeout length.
resolver valid=10m;
resolver_timeout 5s;


You need at least nginx 1.3.7 for OCSP stapling to work.

Run nginx -t to test your configuration, before reloading.


One more thing...

Keep learning

So you are interested in Linux security? Join the Linux Security Expert training program, a practical and lab-based training ground. For those who want to become (or stay) a Linux security expert.

See training package

Lynis Enterprise screenshot to help with system hardeningSecurity scanning with Lynis and Lynis Enterprise

Run automated security scans and increase your defenses. Lynis is an open source security tool to perform in-depth audits. It helps with system hardening, vulnerability discovery, and compliance.


Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.