Knowledge Base

Overview

By following this article you will confirm that your NGINX version supports OCSP (Online Certificate Status Protocol) stapling, check whether stapling is already active, configure the required directives, and verify that the server returns a stapled response. The article covers the OCSP responder URL (Uniform Resource Locator) published in the certificate's AIA (Authority Information Access) extension, the trusted certificate chain NGINX uses to verify a response, the DNS (Domain Name System) resolver NGINX needs to reach the responder by hostname, testing with the SNI (Server Name Indication) hostname, and troubleshooting the most common failures.

What Is OCSP Stapling?

OCSP (Online Certificate Status Protocol) stapling is a TLS feature in which the web server obtains the signed certificate revocation status from the issuing CA (Certificate Authority), caches it, and delivers it to the client during the TLS handshake. Stapling improves handshake performance and protects client privacy, because the client no longer contacts the CA directly to check whether the server certificate has been revoked.

Similar Questions

• How do I enable OCSP stapling on NGINX?
• Why is OCSP stapling not working on my NGINX server?
• What are the steps to verify OCSP stapling with OpenSSL?
• NGINX ssl_stapling configuration example

Prerequisites

• NGINX version 1.3.7 or later is installed.
• The SSL/TLS certificate and private key are installed correctly.
• The server presents the complete certificate chain to clients.
• A trusted certificate chain or CA (Certificate Authority) bundle is available for response verification.
• The server can make outbound HTTP/HTTPS connections to the OCSP (Online Certificate Status Protocol) responder listed in the certificate.
• A DNS (Domain Name System) resolver is available to NGINX if it must resolve responder hostnames at runtime.

Step 1 — Verify the NGINX version

OCSP (Online Certificate Status Protocol) stapling is supported in NGINX 1.3.7 and later. Check the installed version:

nginx -v

If the server runs an older version, upgrade NGINX before continuing.

Step 2 — Check whether OCSP stapling is already enabled

Before changing the configuration, confirm whether the server already returns a stapled OCSP (Online Certificate Status Protocol) response.

Check with OpenSSL

Run the following command against the site you are testing. Include the -servername option so the test presents the correct SNI (Server Name Indication) hostname:

openssl s_client -connect your-domain.com:443 -servername your-domain.com -status

If stapling is working, the output contains an OCSP Response Data section and this status line:

OCSP Response Status: successful (0x0)

Check with an SSL testing tool

You can also validate a public endpoint with an SSL testing service such as Qualys SSL Labs Server Test or the DigiCert SSL Installation Checker. Status wording varies by tool. Do not rely on a single label such as "Not Supported" without also reviewing the full certificate chain and the OCSP details the tool reports.

Step 3 — Identify and test the OCSP responder

NGINX uses the OCSP (Online Certificate Status Protocol) responder URL (Uniform Resource Locator) published in the certificate's AIA (Authority Information Access) extension. Do not hardcode responder IP addresses, because responder infrastructure can change.

Display the responder URL published in your certificate:

openssl x509 -in certificate.crt -noout -ocsp_uri

Example output:

http://ocsp.sectigo.com

The value shown above is illustrative. Always use the responder URL returned by your own certificate.

Test connectivity to the responder

Confirm that the server can reach the responder address returned in the previous command:

curl -I http://ocsp.sectigo.com

or:

nc -vz ocsp.sectigo.com 80

If connectivity fails, check firewall rules, proxy settings, DNS (Domain Name System) resolution, network filtering policies, and outbound access on the responder port — typically TCP (Transmission Control Protocol) port 80 for OCSP over HTTP.

Step 4 — Configure NGINX for OCSP stapling

Edit the TLS server block for the site. The file location depends on the Linux distribution and the NGINX installation method:

nano /etc/nginx/sites-available/your-domain.conf

or:

nano /etc/nginx/conf.d/your-domain.conf

Add the OCSP (Online Certificate Status Protocol) stapling directives inside the TLS server block:

ssl_stapling on;
ssl_stapling_verify on;

Then point NGINX to a trusted certificate chain or CA (Certificate Authority) bundle that allows it to build trust from the issuing CA to a trusted root:

ssl_trusted_certificate /etc/nginx/ssl/trusted-chain.pem;

The ssl_certificate directive presents the server certificate and intermediate chain to clients. The ssl_trusted_certificate directive is used only by NGINX for verification tasks such as OCSP response validation.

Stapling does not have to be limited to the default_server. For multiple TLS virtual hosts, configure stapling in each applicable server block, or apply shared directives at the http level, and confirm each certificate has the correct chain and trusted CA configuration.

Step 5 — Configure DNS resolution for the OCSP responder

If the OCSP (Online Certificate Status Protocol) responder is referenced by hostname, NGINX needs a DNS (Domain Name System) resolver to resolve that name. Add a resolver approved by your organization or hosting provider:

resolver 1.1.1.1 8.8.8.8 valid=300s;
resolver_timeout 5s;

The resolver addresses shown above are placeholders. Replace them with your organization-approved resolvers if internal DNS policy requires it.

Example server block

server {
    listen 443 ssl;
    server_name your-domain.com;
    root /srv/www/your-domain/public_html;
    index index.html index.htm;
    ssl_certificate /etc/nginx/ssl/your-domain/fullchain.pem;
    ssl_certificate_key /etc/nginx/ssl/your-domain/private.key;
    ssl_stapling on;
    ssl_stapling_verify on;
    ssl_trusted_certificate /etc/nginx/ssl/trusted-chain.pem;
    resolver 1.1.1.1 8.8.8.8 valid=300s;
    resolver_timeout 5s;
}

Step 6 — Test the configuration and reload NGINX

Validate the NGINX configuration syntax before applying it:

nginx -t

When the output confirms that the syntax is OK and the test is successful, reload NGINX. Reloading applies the new configuration without a full service restart:

systemctl reload nginx

On some systems the equivalent command is:

service nginx reload

How to Verify OCSP Stapling Was Enabled Successfully

To confirm that NGINX now returns a stapled OCSP (Online Certificate Status Protocol) response, run the OpenSSL test again:

openssl s_client -connect your-domain.com:443 -servername your-domain.com -status

The configuration is working when the output contains an OCSP Response Data section and the status line OCSP Response Status: successful (0x0).

Troubleshooting

Frequently Asked Questions