Enterprise Cloud Security and Governance

An ideal solution

When OCSP stapling is enabled, the web server itself will query the OCSP server and will cache the response. This response is then stapled in the certificate status request extension.

This can easily be implemented with nginx; here is the associated configuration:

 ssl_stapling on; ssl_stapling_verify on; ssl_trusted_certificate /etc/ssl/zealvora_com.ca-bundle;  

The ssl_trusted_certificate directive should point to the intermediate root certificate bundle.

The configuration file looks similar to the following screenshot:

To verify if the OCSP stapling is working properly, we can use this command:

echo QUIT | openssl s_client ...