11

I would like to enable OCSP stapling in my Apache server. I'm using:

To the file:

/etc/apache2/sites-available/default-ssl.conf

I added:

SSLUseStapling on

Then, I edited:

/etc/apache2/mods-available/ssl.conf

adding this line:

SSLStaplingCache shmcb:/tmp/stapling_cache(128000)

I read that this would be sufficient to enable OCSP stapling.

I checked the syntax with:

sudo apachectl -t

and it was OK.

However, upon reloading, Apache can't start.

EDIT1:

Following this guide.

Inside my SSL virtual host file:

/etc/apache2/sites-available/default-ssl.conf

I added these lines below my sets of SSLCertificateFile, SSLCertificateKeyFile:

SSLUseStapling on
SSLStaplingReturnResponderErrors off
SSLStaplingResponderTimeout 5

I then edited this file:

/etc/apache2/mods-available/ssl.conf

adding this line:

SSLStaplingCache shmcb:${APACHE_RUN_DIR}/ssl_stapling_cache(128000)

I can now restart Apache without problems, however, OCSP does not seem to be working, based upon:

openssl s_client -connect www.example.com:443 -servername www.example.com -status < /dev/null
OCSP response: no response sent

What am I doing wrong, is it something related to my Let's Encrypt certificate?

  • On your config, I expect it's using an anonymous mapping, so the file name doesn't actually matter. The error says its run out of memory—is it possible you have some resource limit set that's keeping it from grabbing shared memory? – derobert May 5 '17 at 17:25
  • @derobert please check my update – NineCattoRules May 6 '17 at 9:55
  • 3
    That looks like it should work—I have a similar config running and it works (though my staping setup is server-wide, not just one vhost). I'd suggest changing LogLevel to see if you can get the reason it failed out of Apache. The only obvious one I can think of is if you have a firewall restricting outgoing traffic—it needs to let the OCSP request through. – derobert May 6 '17 at 16:07
  • 1
    Did you try changing the LogLevel to see if you can get an error message out of Apache? – derobert May 16 '17 at 16:19
  • 1
    There are a few log levels between warn and debug. I'd try info first. – derobert May 17 '17 at 18:11
0

I ran into this a while ago myself, but I seem to have fixed it.

$ openssl s_client -connect berb.ec:443 -servername berb.ec -status < /dev/null 2>&1 | grep "OCSP Response Status"
OCSP Response Status: successful (0x0)

SSLLabs agrees: 97.5% (I have to enable a cipher for my LG phone)

edit: SSLLabs agrees: 100% Got 100% fixed. Stupid phone and curve support.

In my situation, I was using the common line:

SSLCertificateFile /etc/letsencrypt/live/berb.ec/cert.pem

I changed to the fullchain.pem file and all is good.

SSLCertificateFile /etc/letsencrypt/live/berb.ec/fullchain.pem

Alternatively, you can add a line to your VirtualHost file

SSLCACertificateFile /etc/letsencrypt/live/berb.ec/chain.pem

This is my full /etc/apache2/conf-enabled/ssl.conf file. The only SSL items in the VirtualHost file are the SSLEngine, SSLCertificateFile and SSLCertificateKeyFile.

SSLProtocol             -all +TLSv1.2
SSLCipherSuite          ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384
SSLOpenSSLConfCmd       DHParameters    "/etc/apache2/dhparam4096.pem"
SSLOpenSSLConfCmd       ECDHParameters secp384r1
SSLOpenSSLConfCmd       Curves          secp521r1:secp384r1
SSLUseStapling          On
SSLStaplingCache        "shmcb:/logs/ssl_stapling(32768)"
SSLCompression off
SSLHonorCipherOrder on
Header always set X-Frame-Options SAMEORIGIN
Header always edit Set-Cookie (.*) "$1;HttpOnly;Secure"
Header edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure
Header always set X-Content-Type-Options nosniff
SSLOptions +StrictRequire

I'm still working on OCSP Must Staple

EDIT1: Got OCSP Must Staple working. It's an option in the certbot client:

certbot --must-staple --rsa-key-size 4096
0

For answering your question, I am copying and pasting some of the apache2.conf settings of my Apache server, which provides grade A encryption on my page with Let's Encrypt SSL certificates:

#Required modules
LoadModule socache_shmcb_module /usr/lib/apache2/modules/mod_socache_shmcb.so
LoadModule ssl_module           /usr/lib/apache2/modules/mod_ssl.so

#SSL settings
SSLCipherSuite ECDHE:AES256-SHA:AES128-SHA:DES-CBC3-SHA:!RC4
SSLHonorCipherOrder on
SSLRandomSeed connect file:/dev/urandom 32
SSLSessionCache shmcb:${APACHE_RUN_DIR}/ssl(512000)
SSLSessionCacheTimeout 86400
SSLStaplingCache shmcb:${APACHE_RUN_DIR}/ocsp(128000)
SSLUseStapling on

Additionally you may see this answer for strengthening the SSLCipherSuite.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.