Let's Encrypt - Apache - OCSP stapling

Question

I would like to enable OCSP stapling in my Apache server. I'm using:

• Server: Apache/2.4.7 on Ubuntu
• Certificate: Let's Encrypt

To the file:

/etc/apache2/sites-available/default-ssl.conf

I added:

SSLUseStapling on

Then, I edited:

/etc/apache2/mods-available/ssl.conf

adding this line:

SSLStaplingCache shmcb:/tmp/stapling_cache(128000)

I read that this would be sufficient to enable OCSP stapling.

I checked the syntax with:

sudo apachectl -t

and it was OK.

However, upon reloading, Apache can't start.

EDIT1:

Following this guide.

Inside my SSL virtual host file:

/etc/apache2/sites-available/default-ssl.conf

I added these lines below my sets of SSLCertificateFile, SSLCertificateKeyFile:

SSLUseStapling on
SSLStaplingReturnResponderErrors off
SSLStaplingResponderTimeout 5

I then edited this file:

/etc/apache2/mods-available/ssl.conf

adding this line:

SSLStaplingCache shmcb:${APACHE_RUN_DIR}/ssl_stapling_cache(128000)

I can now restart Apache without problems, however, OCSP does not seem to be working, based upon:

openssl s_client -connect www.example.com:443 -servername www.example.com -status < /dev/null

OCSP response: no response sent

What am I doing wrong, is it something related to my Let's Encrypt certificate?

Answer 1

I ran into this a while ago myself, but I seem to have fixed it.

$ openssl s_client -connect berb.ec:443 -servername berb.ec -status < /dev/null 2>&1 | grep "OCSP Response Status"
OCSP Response Status: successful (0x0)

SSLLabs agrees: 97.5% (I have to enable a cipher for my LG phone)

edit: SSLLabs agrees: 100% Got 100% fixed. Stupid phone and curve support.

In my situation, I was using the common line:

SSLCertificateFile /etc/letsencrypt/live/berb.ec/cert.pem

I changed to the fullchain.pem file and all is good.

SSLCertificateFile /etc/letsencrypt/live/berb.ec/fullchain.pem

Alternatively, you can add a line to your VirtualHost file

SSLCACertificateFile /etc/letsencrypt/live/berb.ec/chain.pem

This is my full /etc/apache2/conf-enabled/ssl.conf file. The only SSL items in the VirtualHost file are the SSLEngine, SSLCertificateFile and SSLCertificateKeyFile.

SSLProtocol             -all +TLSv1.2
SSLCipherSuite          ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384
SSLOpenSSLConfCmd       DHParameters    "/etc/apache2/dhparam4096.pem"
SSLOpenSSLConfCmd       ECDHParameters secp384r1
SSLOpenSSLConfCmd       Curves          secp521r1:secp384r1
SSLUseStapling          On
SSLStaplingCache        "shmcb:/logs/ssl_stapling(32768)"
SSLCompression off
SSLHonorCipherOrder on
Header always set X-Frame-Options SAMEORIGIN
Header always edit Set-Cookie (.*) "$1;HttpOnly;Secure"
Header edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure
Header always set X-Content-Type-Options nosniff
SSLOptions +StrictRequire

I'm still working on OCSP Must Staple

EDIT1: Got OCSP Must Staple working. It's an option in the certbot client:

certbot --must-staple --rsa-key-size 4096

Answer 2

For answering your question, I am copying and pasting some of the apache2.conf settings of my Apache server, which provides grade A encryption on my page with Let's Encrypt SSL certificates:

#Required modules
LoadModule socache_shmcb_module /usr/lib/apache2/modules/mod_socache_shmcb.so
LoadModule ssl_module           /usr/lib/apache2/modules/mod_ssl.so

#SSL settings
SSLCipherSuite ECDHE:AES256-SHA:AES128-SHA:DES-CBC3-SHA:!RC4
SSLHonorCipherOrder on
SSLRandomSeed connect file:/dev/urandom 32
SSLSessionCache shmcb:${APACHE_RUN_DIR}/ssl(512000)
SSLSessionCacheTimeout 86400
SSLStaplingCache shmcb:${APACHE_RUN_DIR}/ocsp(128000)
SSLUseStapling on

Additionally you may see this answer for strengthening the SSLCipherSuite.