Enabling OCSP stapling can significantly improve the performance and privacy of your website's SSL/TLS connections. When using Let's Encrypt certificates, configuring OCSP stapling ensures that browsers can verify your certificate's validity quickly without repeatedly contacting the certificate authority.

What is OCSP Stapling?

OCSP stapling is a method that allows your web server to 'staple' a time-stamped, signed OCSP response from the Certificate Authority (CA) to the TLS handshake. This reduces the need for browsers to contact the CA directly, leading to faster connection times and increased privacy.

Prerequisites

  • A server running a web server like Nginx or Apache.
  • A valid Let's Encrypt SSL certificate installed on your server.
  • Access to your server's configuration files.
  • OpenSSL installed on your server (for some steps).

Enabling OCSP Stapling on Nginx

Follow these steps to enable OCSP stapling in Nginx:

1. Edit Your Nginx Configuration

Open your server block configuration file, typically located in /etc/nginx/sites-available/ or /etc/nginx/conf.d/.

2. Add OCSP Stapling Settings

Within your server block, add or modify the following lines:

ssl_stapling on;

ssl_stapling_verify on;

Ensure that your SSL certificate and key are correctly specified:

ssl_certificate /path/to/fullchain.pem;

ssl_certificate_key /path/to/privkey.pem;

Optionally, specify the resolver:

resolver 8.8.8.8 8.8.4.4 valid=300s;

3. Test and Reload Nginx

Test your configuration for syntax errors:

sudo nginx -t

If successful, reload Nginx:

sudo systemctl reload nginx

Enabling OCSP Stapling on Apache

For Apache users, follow these steps:

1. Enable Required Modules

Ensure these modules are enabled:

  • ssl
  • socache_shmcb

Enable modules if needed:

sudo a2enmod ssl socache_shmcb

2. Configure SSL Settings

Edit your SSL VirtualHost configuration file, typically in /etc/apache2/sites-available/.

Add or ensure the following directives are present:

SSLUseStapling on

SSLStaplingCache "shmcb:logs/stapling-cache(128000)"

And specify your certificate files:

SSLCertificateFile /path/to/fullchain.pem

SSLCertificateKeyFile /path/to/privkey.pem

3. Restart Apache

Apply changes by restarting Apache:

sudo systemctl restart apache2

Verifying OCSP Stapling

After configuration, verify that OCSP stapling is working:

  • Use online tools like SSL Labs SSL Test.
  • Check your server’s response with command-line tools such as:

openssl s_client -connect yourdomain.com:443 -status

Look for the OCSP Response section to confirm stapling is active.

Conclusion

Enabling OCSP stapling with Let's Encrypt certificates is a straightforward process that can enhance your website's performance and privacy. By following these steps for your web server, you ensure faster SSL handshakes and a better experience for your visitors.