03-02-2014 | Remy van Elst
OCSP stapling is an enhancement to the standard OCSP protocol that delivers OCSP responses from the server with the certificate, eliminating the need for relying parties (web users) to check OCSP responses with the issuing CA. This has the effect of reducing bandwidth, improving perceived site performance, and increasing security for everyone involved in establishing the secure session. This tutorial shows you how to set it up with nginx.
OCSP stapling is defined in the IETF RFC 6066. The term "stapling" is a popular term used to describe how the OCSP response is obtained by the web server. The web server caches the response from the CA that issued the certificate. When an SSL/TLS handshake is initiated, the response is returned by the web server to the client by attaching the cached OCSP response to the CertificateStatus message. To make use of OCSP stapling, a client must include the "status_request" extension with its SSL/TSL Client "Hello" message.
OCSP stapling presents several advantages including the following:
You need at least nginx 1.3.7 for this to work. This is not available in the current Ubuntu LTS releases (12.04), it has 1.1.19 and on CentOS you need EPEL or the official repositories. However, it is easy to install the latest version of nginx.
You also need create a firewall exception to allow your server to make outbound connections to the upstream OCSP's. You can view all OCSP URI's from a website using this one liner:
OLDIFS=$IFS; IFS=':' certificates=$(openssl s_client -connect google.com:443 -showcerts -tlsextdebug -tls1 2>&1
It results for google.com in:
Add the below configuration to your https (443)
ssl_stapling on; ssl_stapling_verify on; resolver 126.96.36.199 188.8.131.52 valid=300s; resolver_timeout 5s;
For the OCSP stapling to work, the certificate of the server certificate issuer should be known. If the
ssl_certificate file does not contain intermediate certificates, the certificate of the server certificate issuer should be present in the
My certificate for raymii.org is issues by
Positive CA 2. That certificate is issued by
Addtrust External CA Root. In my nginx
ssl_certificate file all these certificates are present. If that for you is not the case, create a file with the certificate chain and use it like so:
Before version 1.1.7, only a single name server could be configured. Specifying name servers using IPv6 addresses is supported starting from versions 1.3.1 and 1.2.2. By default, nginx will look up both IPv4 and IPv6 addresses while resolving. If looking up of IPv6 addresses is not desired, the
ipv6=off parameter can be specified. Resolving of names into IPv6 addresses is supported starting from version 1.5.8.
By default, nginx caches answers using the TTL value of a response. The (optional)
valid parameter allows overrides it to be 5 minutes. Before version 1.1.9, tuning of caching time was not possible, and nginx always cached answers for the duration of 5 minutes.
Restart your nginx to load the new configuration:
service nginx restart
And it should work. Let's test it.
Fire up a terminal and use the following OpenSSL command to connect to your website:
openssl s_client -connect example.org:443 -tls1 -tlsextdebug -status
In the response, look for the following:
OCSP response: ====================================== OCSP Response Data: OCSP Response Status: successful (0x0) Response Type: Basic OCSP Response Version: 1 (0x0) Responder Id: 99E4405F6B145E3E05D9DDD36354FC62B8F700AC Produced At: Feb 3 04:25:39 2014 GMT Responses: Certificate ID: Hash Algorithm: sha1 Issuer Name Hash: 0226EE2F5FA2810834DACC3380E680ACE827F604 Issuer Key Hash: 99E4405F6B145E3E05D9DDD36354FC62B8F700AC Serial Number: C1A3D8D00D72FCE483CD84759E9EC0BC Cert Status: good This Update: Feb 3 04:25:39 2014 GMT Next Update: Feb 7 04:25:39 2014 GMT
That means it is working. If you get a response like below, it is not working:
OCSP response: no response sent
You can also use the SSL Labs test to see if OCSP stapling works.