When a certificate is compromised, the certificate authority (CA) revokes it. Browsers need a way to learn about revocations. OCSP stapling lets your server fetch a signed "still valid" response from the CA and attach (staple) it to the TLS handshake. This guide explains how it works, where things are heading, and how to enable it.
Before you start
- A Linux server with Nginx or Apache and a certificate from a CA.
- Check whether your certificate even includes an OCSP URL:
openssl x509 -in cert.pem -noout -ocsp_uri. If nothing prints, OCSP stapling does not apply.
Note: Let's Encrypt announced the end of its OCSP service and has removed OCSP URLs from new certificates in favour of CRLs, so OCSP stapling has no effect for Let's Encrypt certificates issued after that change. Many commercial CAs still provide OCSP.
Revocation checking in short
- CRL – the CA publishes a list of revoked certificates. Browsers increasingly use compressed, browser-distributed CRL sets.
- OCSP – the browser asks the CA about one certificate. This adds latency and tells the CA which sites users visit.
- OCSP stapling – the server asks the CA periodically and includes the signed answer in the handshake. Faster and more private for visitors.
Enable OCSP stapling on Nginx
ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /etc/ssl/certs/chain.pem;
resolver 1.1.1.1 9.9.9.9 valid=300s;
resolver_timeout 5s;ssl_trusted_certificatemust contain the CA's intermediate (and root) certificates so Nginx can verify responses.resolverlets Nginx look up the OCSP server's hostname; use a local resolver if you have one.
Reload: sudo nginx -t && sudo systemctl reload nginx.
Enable OCSP stapling on Apache
Outside any <VirtualHost> block:
SSLStaplingCache shmcb:/var/run/ocsp(128000)Inside each HTTPS virtual host:
SSLUseStapling on
SSLStaplingResponderTimeout 5
SSLStaplingReturnResponderErrors offReload Apache after apachectl configtest.
Test it
echo | openssl s_client -connect example.com:443 -servername example.com -status 2>/dev/null | grep -A 3 'OCSP response'You want OCSP Response Status: successful and Cert Status: good. Nginx fetches the response lazily, so the first request after a reload may show no response sent – run the test twice.
Troubleshooting
- "no response sent" repeatedly: the server can't reach the OCSP URL (outbound firewall or DNS), or the certificate has no OCSP URL.
- Verify errors in the Nginx log:
ssl_trusted_certificateis missing the intermediate certificate. - Must-Staple certificates fail: certificates with the OCSP Must-Staple extension break if stapling stops working – avoid Must-Staple unless you monitor it closely.
FAQ: OCSP stapling
Is OCSP stapling still worth enabling?
Yes for certificates that include an OCSP URL – it costs nothing and improves privacy and speed. For certificates without OCSP, it does nothing.
Does OCSP stapling replace HSTS?
No. HSTS forces HTTPS; stapling speeds up revocation checks. They solve different problems.
Do I need it on cPanel hosting?
No, the host manages TLS settings on shared servers.