Knowledge Base

Enable OCSP Stapling on Apache

Updated on September 26, 2026

Overview

By following this article, you will configure Apache HTTP Server to staple a certificate revocation response to the TLS handshake, and confirm that the stapled response is being served. The article covers the prerequisites, how to check the Apache version, how to test whether Online Certificate Status Protocol (OCSP) stapling is already enabled, how to verify connectivity to the OCSP responder identified in the certificate Authority Information Access (AIA) extension, how to add the stapling directives and the stapling cache to the Apache configuration, and how to reload and verify the result. Two terms are used throughout: the OCSP responder is the Certificate Authority (CA) service that reports whether a certificate is still valid, and the stapling cache is the shared memory area where Apache stores the response it retrieves.

Prerequisites

Before you begin, confirm the following on the Apache HTTP Server you are configuring.

Apache HTTP Server 2.3.3 or later is installed. Apache 2.4 or later is recommended.
The mod_ssl module is enabled.
The SSL certificate is installed correctly.
The server is configured to send the complete certificate chain.
The server can make outbound HTTP or HTTPS connections to the OCSP responder named in the certificate.

Check the Apache version

OCSP stapling is supported in Apache HTTP Server 2.3.3 and later. Check the installed version with one of the following commands, depending on how Apache is packaged on your system.

apache2 -v httpd -v

If the server runs an older version, upgrade Apache HTTP Server before continuing.

Check whether OCSP stapling is already enabled

Before changing the configuration, test whether the server already staples an OCSP response. You can test from the command line or with a public testing service.

Test with OpenSSL

Run the following command against the site, replacing your-domain.com with your own domain name.

openssl s_client -connect your-domain.com:443 -servername your-domain.com -status

If OCSP stapling is working, the output contains an OCSP Response Data section and the following status line.

OCSP Response Status: successful (0x0)

Test with an SSL testing service

A public SSL testing service, such as SSL Labs Server Test or the DigiCert SSL Installation Checker, also reports whether the site staples an OCSP response. The exact wording varies by tool. Common results include Good, Enabled, Not Enabled, or No Response. If no stapled OCSP response is reported, continue with the remaining sections.

Verify connectivity to the OCSP responder

Apache HTTP Server must be able to reach the OCSP responder named in the certificate Authority Information Access (AIA) extension. Identify the responder address, then confirm the server can connect to it.

Find the responder address

Run the following command against the certificate file to read the responder Uniform Resource Locator (URL) from the certificate.

openssl x509 -in certificate.crt -noout -text | grep -A1 "OCSP"

The output shows the responder address, for example:

image_VXVmkl/5D5YAYes/Gmmw9w==

ocsp.sectigo.com

Always use the responder address embedded in the certificate. Do not rely on hardcoded hostnames or IP addresses, because the responder differs by certificate issuer.

Test the connection to the responder

Test outbound connectivity from the Apache HTTP Server to the responder address you found, using either of the following commands.

image_VXVmkl/5D5YAYes/Gmmw9w==

ocsp.sectigo.com nc -vz ocsp.sectigo.com 80

If the connection fails, check the firewall rules, proxy settings, network filtering policies, and outbound access on ports 80 and 443.

Configure Apache for OCSP stapling

Enabling OCSP stapling requires three changes to the Apache HTTP Server configuration: the stapling directives inside the virtual host, a complete certificate chain, and a stapling cache defined at server level.

Add the stapling directives inside the VirtualHost block

Open the SSL virtual host configuration file for the site, for example:

image_VXVmkl/5D5YAYes/Gmmw9w==

your-domain-ssl.conf

Add the following directives inside the <VirtualHost> block.

SSLUseStapling On
SSLStaplingResponderTimeout 5
SSLStaplingReturnResponderErrors Off

Confirm the full certificate chain is installed

Apache HTTP Server needs the complete certificate chain to validate the OCSP responses it receives. On current Apache versions this is usually supplied through a full-chain certificate file, or an equivalent chain configuration suited to your environment.

image_VXVmkl/5D5YAYes/Gmmw9w==

fullchain.pem

Add the stapling cache outside the VirtualHost block

The stapling cache stores the OCSP response Apache retrieves, so it must be defined once at server level and not inside a virtual host.

ocsp(128000)

Example configuration

The following example shows the OCSP stapling directives and the stapling cache in a complete SSL virtual host configuration for Apache HTTP Server.

<IfModule mod_ssl.c>
    SSLStaplingCache shmcb:/var/run/ocsp(128000)
    <VirtualHost *:443>
        ServerName your-domain.com
        DocumentRoot /var/www/html
        SSLEngine On
        SSLCertificateFile /etc/ssl/your-domain/fullchain.pem
        SSLCertificateKeyFile /etc/ssl/your-domain/private.key
        SSLUseStapling On
        SSLStaplingResponderTimeout 5
        SSLStaplingReturnResponderErrors Off
    </VirtualHost>
</IfModule>

Validate the configuration and reload Apache

Check the Apache HTTP Server configuration for syntax errors before reloading the service.

apachectl -t

The expected result is:

Syntax OK

Reload Apache HTTP Server so the new OCSP stapling directives take effect. The service name depends on the Linux distribution.

On Debian and Ubuntu, reload the apache2 service.

systemctl reload apache2

On Red Hat Enterprise Linux (RHEL), CentOS, Rocky Linux, and AlmaLinux, reload the httpd service.

systemctl reload httpd

Verify OCSP stapling

Confirm that the Apache HTTP Server now staples an OCSP response by running the same OpenSSL test used earlier.

openssl s_client -connect your-domain.com:443 -servername your-domain.com -status

A working configuration returns an OCSP Response Data section and the following status line.

OCSP Response Status: successful (0x0)

Note that a missing stapled response does not always mean OCSP stapling is disabled. It can also indicate a connectivity problem, an incomplete certificate chain, a responder issue at the Certificate Authority (CA), or that Apache has not yet cached a valid OCSP response.

Troubleshooting

If the verification test returns no stapled OCSP response, check the following on the Apache HTTP Server.

Confirm the server can reach the OCSP responder address.
Confirm the certificate chain is complete.
Review the Apache error logs for OCSP-related messages.
Confirm the mod_ssl module is enabled.
Confirm the certificate includes a responder address in its Authority Information Access (AIA) extension.
Retest after Apache has had time to retrieve and cache a response.