Let' encrypt - nginx - OCSP stapling

Question

I would like to enable OCSP stapling in my nginx server. I'm using

• nginx version: nginx/1.6.2
• debian
• Let's Encrypt certificate

I'm really unexperienced in this matter, so it might be a trivial issue.

Here my nginx security config

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:10m;
    ssl_dhparam /etc/ssl/private/dhparams_4096.pem;

Here my site/Server security config:

    add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload";

    # All files have been generated by Let's encrypt
    ssl_certificate /etc/letsencrypt/live/myexample.org/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/myexample.org/privkey.pem;

    # Everything below this line was added to enable OCSP stapling
    # What is that (generated file) and is that required at all?
    ssl_trusted_certificate /etc/letsencrypt/live/myexample.org/chain.pem;

    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 8.8.8.8 8.8.4.4 valid=300s;
    resolver_timeout 5s;

I read that this would be sufficient to enable OCSP stapling.

But if I test it using

 openssl s_client -connect myexample.org:443 -tls1 -tlsextdebug -status

I will get the following response:

TLS server extension "renegotiation info" (id=65281), len=1
0001 - <SPACES/NULS>
TLS server extension "EC point formats" (id=11), len=4
0000 - 03 00 01 02                                       ....
TLS server extension "session ticket" (id=35), len=0
TLS server extension "heartbeat" (id=15), len=1
0000 - 01                                                .
OCSP response: no response sent
depth=1 C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X1
verify error:num=20:unable to get local issuer certificate
verify return:0
---
Certificate chain
 0 s:/CN=myexample.org
   i:/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X1
 1 s:/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X1
   i:/O=Digital Signature Trust Co./CN=DST Root CA X3
---
[...]

Especially

OCSP response: no response sent

What am I doing wrong?

Certificate hierarchy:

• DST Root CA X3
  • Let's Encrypt Authority X1
    • myexample.org

EDIT:

OCSP: URI: http://ocsp.int-x1.letsencrypt.org/
CA-Issuer: URI: http://cert.int-x1.letsencrypt.org/

Answer 1

Following the standard nginx setup, you should not need to specify a ssl_trusted_certificate chain. The following should be sufficient:

ssl_certificate /etc/letsencrypt/live/myexample.org/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/myexample.org/privkey.pem;
ssl_stapling on;
ssl_stapling_verify on;

See here for further context.

Answer 2

I found the solution based on the tutorial I found there:

cd /etc/ssl/private
wget -O - https://letsencrypt.org/certs/isrgrootx1.pem https://letsencrypt.org/certs/lets-encrypt-x1-cross-signed.pem https://letsencrypt.org/certs/letsencryptauthorityx1.pem https://www.identrust.com/certificates/trustid/root-download-x3.html | tee -a ca-certs.pem> /dev/null

and add this to your site/server config

ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /etc/ssl/private/ca-certs.pem;

Reload your config

IMPORTANT: Open your browser and access your webpage once.

Then you can test your server locally with this cmd:

openssl s_client -connect myexample.org:443 -tls1 -tlsextdebug -status

You will most likely get a valid response like this

OCSP response:
======================================
OCSP Response Data:
    OCSP Response Status: successful (0x0)
    Response Type: Basic OCSP Response
    Version: 1 (0x0)
    Responder Id: C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X1

Don't worry if you get a

Verify return code: 20 (unable to get local issuer certificate)

at the bottom as well, the Let's encrypt certificate is not yet in the default trusted certificate stores. (I don't have much ssl experience, so I might be wrong)

The error will not show up if you execute the following cmd on the server:

openssl s_client -CApath /etc/ssl/private/ -connect myexample.org:443 -tls1 -tlsextdebug -status

After that you can test your server using:

https://www.digicert.com/help/

Be aware that right now OCSP reponses won't be picked up by the ssllabs tests. I assume this is because the Let's encrypt certificate is not yet in the default trusted certificate stores.