10

I would like to enable OCSP stapling in my nginx server. I'm using

  • nginx version: nginx/1.6.2
  • debian
  • Let's Encrypt certificate

I'm really unexperienced in this matter, so it might be a trivial issue.

Here my nginx security config

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:10m;
    ssl_dhparam /etc/ssl/private/dhparams_4096.pem;

Here my site/Server security config:

    add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload";

    # All files have been generated by Let's encrypt
    ssl_certificate /etc/letsencrypt/live/myexample.org/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/myexample.org/privkey.pem;

    # Everything below this line was added to enable OCSP stapling
    # What is that (generated file) and is that required at all?
    ssl_trusted_certificate /etc/letsencrypt/live/myexample.org/chain.pem;

    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 8.8.8.8 8.8.4.4 valid=300s;
    resolver_timeout 5s;

I read that this would be sufficient to enable OCSP stapling.

But if I test it using

 openssl s_client -connect myexample.org:443 -tls1 -tlsextdebug -status

I will get the following response:

TLS server extension "renegotiation info" (id=65281), len=1
0001 - <SPACES/NULS>
TLS server extension "EC point formats" (id=11), len=4
0000 - 03 00 01 02                                       ....
TLS server extension "session ticket" (id=35), len=0
TLS server extension "heartbeat" (id=15), len=1
0000 - 01                                                .
OCSP response: no response sent
depth=1 C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X1
verify error:num=20:unable to get local issuer certificate
verify return:0
---
Certificate chain
 0 s:/CN=myexample.org
   i:/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X1
 1 s:/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X1
   i:/O=Digital Signature Trust Co./CN=DST Root CA X3
---
[...]

Especially

OCSP response: no response sent

What am I doing wrong?

Certificate hierarchy:

  • DST Root CA X3
    • Let's Encrypt Authority X1
      • myexample.org

EDIT:

OCSP: URI: http://ocsp.int-x1.letsencrypt.org/
CA-Issuer: URI: http://cert.int-x1.letsencrypt.org/
  • Do the certificates in your chain have the OCSP URL set in their AIA extension? – garethTheRed Feb 2 '16 at 21:56
  • 1
    @Braiam - have you linked to the correct document? There's not a mention of OCSP in there. To whoever +1 that comment - did you read it first? – garethTheRed Feb 3 '16 at 7:23
  • @garethTheRed I've editted my post to add the OCSP URL from the certificate. – ST-DDT Feb 3 '16 at 17:10
  • @Braiam I have read your linked document and AFAICT I did everything as described in there properly. (Except for the cronjob, which is neither relevant for security nor my question) – ST-DDT Feb 3 '16 at 17:16
  • Great! It's there. Unfortunately, I've not dealt with nginx much, so can't really help you configure it. Whether the URL was actually there was the first thing that sprung to mind. The only other thought is your fullchain.pem and chain.pem files - are they the same? Shouldn't the ssl_trusted_certificate directive also use the fullchain.pem file? – garethTheRed Feb 3 '16 at 18:05
9

Following the standard nginx setup, you should not need to specify a ssl_trusted_certificate chain. The following should be sufficient:

ssl_certificate /etc/letsencrypt/live/myexample.org/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/myexample.org/privkey.pem;
ssl_stapling on;
ssl_stapling_verify on;

See here for further context.

  • Nice, this simplifies my nginx conf and works just as well! – Shautieh Sep 14 '16 at 7:30
  • I still get an error when I test it with this site ssldecoder.org any hint? – Alexander Schranz Oct 12 '16 at 18:01
  • did fix the problem when you have multiple ssl you need to enable it in all blocks else nginx will fail silently. – Alexander Schranz Oct 12 '16 at 19:57
7

I found the solution based on the tutorial I found there:

cd /etc/ssl/private
wget -O - https://letsencrypt.org/certs/isrgrootx1.pem https://letsencrypt.org/certs/lets-encrypt-x1-cross-signed.pem https://letsencrypt.org/certs/letsencryptauthorityx1.pem https://www.identrust.com/certificates/trustid/root-download-x3.html | tee -a ca-certs.pem> /dev/null

and add this to your site/server config

ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /etc/ssl/private/ca-certs.pem;

Reload your config

IMPORTANT: Open your browser and access your webpage once.

Then you can test your server locally with this cmd:

openssl s_client -connect myexample.org:443 -tls1 -tlsextdebug -status

You will most likely get a valid response like this

OCSP response:
======================================
OCSP Response Data:
    OCSP Response Status: successful (0x0)
    Response Type: Basic OCSP Response
    Version: 1 (0x0)
    Responder Id: C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X1

Don't worry if you get a

Verify return code: 20 (unable to get local issuer certificate)

at the bottom as well, the Let's encrypt certificate is not yet in the default trusted certificate stores. (I don't have much ssl experience, so I might be wrong)

The error will not show up if you execute the following cmd on the server:

openssl s_client -CApath /etc/ssl/private/ -connect myexample.org:443 -tls1 -tlsextdebug -status

After that you can test your server using:

https://www.digicert.com/help/

Be aware that right now OCSP reponses won't be picked up by the ssllabs tests. I assume this is because the Let's encrypt certificate is not yet in the default trusted certificate stores.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.