Skip to main content
Deployment

Configuring OCSP Stapling for Performance and Privacy

Configure OCSP stapling to reduce client revocation queries and improve TLS performance and privacy.

CertOne1 min read

OCSP stapling lets a server include certificate status information in the TLS handshake, reducing clients' separate OCSP queries. This guide explains the configuration.

1. What is OCSP stapling?​

1. Definition​

The server includes an OCSP response in the handshake so the client need not contact the OCSP responder separately, improving performance and privacy.

2. Benefits​

  • Performance: fewer OCSP queries
  • Privacy: clients do not need to contact the OCSP responder
  • Lower latency: fewer network requests

2. Configuration​

1. NGINX configuration​

ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /etc/nginx/ssl/chain.crt;
resolver 8.8.8.8 8.8.4.4 valid=300s;
resolver_timeout 5s;

2. Apache configuration​

SSLUseStapling on
SSLStaplingCache "shmcb:logs/ssl_stapling(32768)"

3. Verify the configuration​

1. Test with OpenSSL​

echo | openssl s_client -connect example.com:443 -servername example.com -status

2. Test with SSL Labs​

Visit https://www.ssllabs.com/ssltest/ to inspect the OCSP stapling status.

4. Best practices​

1. Configuration recommendations​

  • ✅ Enable OCSP stapling when supported by the certificate's CA
  • ✅ Configure the certificate chain file
  • ✅ Configure a DNS resolver

2. Considerations​

  • ⚠️ Ensure the certificate chain is complete
  • ⚠️ Configure a working DNS resolver
  • ⚠️ Test OCSP stapling

Conclusion​

For certificates with an OCSP responder, correctly configured stapling reduces client queries and can improve connection performance and privacy.