I would like to enable OCSP stapling in my Apache server. I'm using:

To the file:


I added:

SSLUseStapling on

Then, I edited:


adding this line:

SSLStaplingCache shmcb:/tmp/stapling_cache(128000)

I read that this would be sufficient to enable OCSP stapling.

I checked the syntax with:

sudo apachectl -t

and it was OK.

However, upon reloading, Apache can't start.


Following this guide.

Inside my SSL virtual host file:


I added these lines below my sets of SSLCertificateFile, SSLCertificateKeyFile:

SSLUseStapling on
SSLStaplingReturnResponderErrors off
SSLStaplingResponderTimeout 5

I then edited this file:


adding this line:

SSLStaplingCache shmcb:${APACHE_RUN_DIR}/ssl_stapling_cache(128000)

I can now restart Apache without problems, however, OCSP does not seem to be working, based upon:

openssl s_client -connect www.example.com:443 -servername www.example.com -status < /dev/null
OCSP response: no response sent

What am I doing wrong, is it something related to my Let's Encrypt certificate?

  • On your config, I expect it's using an anonymous mapping, so the file name doesn't actually matter. The error says its run out of memory—is it possible you have some resource limit set that's keeping it from grabbing shared memory?
    – derobert
    May 5, 2017 at 17:25
  • @derobert please check my update May 6, 2017 at 9:55
  • 3
    That looks like it should work—I have a similar config running and it works (though my staping setup is server-wide, not just one vhost). I'd suggest changing LogLevel to see if you can get the reason it failed out of Apache. The only obvious one I can think of is if you have a firewall restricting outgoing traffic—it needs to let the OCSP request through.
    – derobert
    May 6, 2017 at 16:07
  • 1
    Did you try changing the LogLevel to see if you can get an error message out of Apache?
    – derobert
    May 16, 2017 at 16:19
  • 1
    There are a few log levels between warn and debug. I'd try info first.
    – derobert
    May 17, 2017 at 18:11

2 Answers 2


I ran into this a while ago myself, but I seem to have fixed it.

$ openssl s_client -connect berb.ec:443 -servername berb.ec -status < /dev/null 2>&1 | grep "OCSP Response Status"
OCSP Response Status: successful (0x0)

SSLLabs agrees: 97.5% (I have to enable a cipher for my LG phone)

edit: SSLLabs agrees: 100% Got 100% fixed. Stupid phone and curve support.

In my situation, I was using the common line:

SSLCertificateFile /etc/letsencrypt/live/berb.ec/cert.pem

I changed to the fullchain.pem file and all is good.

SSLCertificateFile /etc/letsencrypt/live/berb.ec/fullchain.pem

Alternatively, you can add a line to your VirtualHost file

SSLCACertificateFile /etc/letsencrypt/live/berb.ec/chain.pem

This is my full /etc/apache2/conf-enabled/ssl.conf file. The only SSL items in the VirtualHost file are the SSLEngine, SSLCertificateFile and SSLCertificateKeyFile.

SSLProtocol             -all +TLSv1.2
SSLOpenSSLConfCmd       DHParameters    "/etc/apache2/dhparam4096.pem"
SSLOpenSSLConfCmd       ECDHParameters secp384r1
SSLOpenSSLConfCmd       Curves          secp521r1:secp384r1
SSLUseStapling          On
SSLStaplingCache        "shmcb:/logs/ssl_stapling(32768)"
SSLCompression off
SSLHonorCipherOrder on
Header always set X-Frame-Options SAMEORIGIN
Header always edit Set-Cookie (.*) "$1;HttpOnly;Secure"
Header edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure
Header always set X-Content-Type-Options nosniff
SSLOptions +StrictRequire

I'm still working on OCSP Must Staple

EDIT1: Got OCSP Must Staple working. It's an option in the certbot client:

certbot --must-staple --rsa-key-size 4096

For answering your question, I am copying and pasting some of the apache2.conf settings of my Apache server, which provides grade A encryption on my page with Let's Encrypt SSL certificates:

#Required modules
LoadModule socache_shmcb_module /usr/lib/apache2/modules/mod_socache_shmcb.so
LoadModule ssl_module           /usr/lib/apache2/modules/mod_ssl.so

#SSL settings
SSLHonorCipherOrder on
SSLRandomSeed connect file:/dev/urandom 32
SSLSessionCache shmcb:${APACHE_RUN_DIR}/ssl(512000)
SSLSessionCacheTimeout 86400
SSLStaplingCache shmcb:${APACHE_RUN_DIR}/ocsp(128000)
SSLUseStapling on

Additionally you may see this answer for strengthening the SSLCipherSuite.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.