OCSP stapling is a TLS extension in which the web server fetches a signed Online Certificate Status Protocol (OCSP) response from the certificate authority and "staples" it to the handshake. The browser gets proof that the certificate has not been revoked without contacting the CA itself.
Why it matters
Without stapling, a browser that checks revocation sends your visitor's request to the CA, which adds latency and leaks which sites they visit. Stapling removes that extra round trip. Note that the ecosystem is shifting: some CAs, including Let's Encrypt, have retired OCSP in favor of certificate revocation lists, so check whether your CA still publishes OCSP before configuring it.
Example
An nginx configuration:
ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /etc/ssl/chain.pem;
resolver 1.1.1.1 8.8.8.8 valid=300s;To test, run openssl s_client -connect example.com:443 -status </dev/null and look for "OCSP Response Status: successful".
Common mistakes
- Enabling stapling without a working
resolver, so nginx cannot fetch responses. - Forgetting
ssl_trusted_certificate, which breaks verification of the response. - Testing right after a restart. Servers such as nginx fetch the response lazily, so the first request may have none.
- Enabling the "must-staple" certificate flag without reliable stapling, which can make the site fail.
Related
Get notified when this term updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.