OCSP Stapling in NGINX: Configuration, Testing and Troubleshooting

Key takeaways

• Stapling needs four things in NGINX: ssl_stapling, ssl_stapling_verify, a resolver and a trusted certificate chain file.
• The most common failure is a missing resolver, which leaves stapling silently off, with a warning in the error log.
• NGINX fetches the OCSP response lazily, so the first test connection may show no response. Test a few times.
• Verify with openssl s_client -connect host:443 -status, not just by reading the config.
• Let's Encrypt ended its OCSP service in 2025, so certificates from it cannot be stapled any more. Check your CA before you spend time on this.

What is OCSP stapling?

OCSP (Online Certificate Status Protocol) lets a browser ask a certificate authority (CA) whether a certificate has been revoked. Without stapling, every visitor's browser makes that request, which adds delay and tells the CA which sites the visitor is opening. With stapling, your web server asks the CA's OCSP responder itself, caches the signed answer for a limited time and attaches it to the TLS handshake. The browser can check the CA's signature on the answer without contacting the CA. The protocol is defined in RFC 6960 and the stapling extension in RFC 6066.

Should you still use it? Check your CA first

Before changing any config, confirm that your certificate has an OCSP responder URL. Run openssl x509 -in cert.pem -noout -ocsp_uri. If nothing is printed, there is nothing to staple. Let's Encrypt announced the end of its OCSP support and moved to certificate revocation lists, and stopped issuing certificates with OCSP URLs during 2025. If you use Let's Encrypt, NGINX stapling will not work for new certificates. Read the Let's Encrypt documentation for the current position. Commercial CAs generally still provide OCSP, but browser and CA industry rules are moving towards optional OCSP, so treat this as a configuration to verify, not a permanent feature.

What is the minimum working NGINX configuration?

Put the following in the HTTPS server block (or the http block for all sites). Paths are examples.

ssl_certificate /etc/nginx/ssl/fullchain.pem; # server cert + intermediates
ssl_certificate_key /etc/nginx/ssl/example.com.key;

ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /etc/nginx/ssl/chain.pem; # intermediates + root, to verify the response

resolver 1.1.1.1 9.9.9.9 valid=300s;
resolver_timeout 5s;

• fullchain.pem must contain your certificate first, then the intermediate certificates. Build it with cat example.com.crt intermediate.crt > fullchain.pem.
• ssl_trusted_certificate is used to verify the OCSP response when ssl_stapling_verify is on. It should contain the issuing chain up to a trusted root.
• resolver is required because NGINX has to resolve the hostname of the OCSP responder at runtime. Use a resolver your server can reach, preferably your own internal one, rather than a random public address.

Test and reload without dropping connections:

sudo nginx -t
sudo systemctl reload nginx

The directives are documented in the NGINX SSL module reference.

How do you verify that stapling works?

echo | openssl s_client -connect example.com:443 -servername example.com -status 2>/dev/null | grep -A 8 "OCSP response"

Look for OCSP Response Status: successful and Cert Status: good, with This Update and Next Update times. If you see OCSP response: no response sent, wait a few seconds and run it again. NGINX fetches the response when the first client asks, so the first handshake after a reload often has none. Also check the error log with sudo tail -f /var/log/nginx/error.log while you test.

Which errors appear, and what do they mean?

The exact wording of NGINX log lines can vary by version, so search your own error log for the word "ssl_stapling" or "OCSP".

What other things should you watch?

• Renewal hooks. After certificates are renewed, reload NGINX so it loads the new files. With Certbot, a deploy hook that runs systemctl reload nginx does this.
• Multiple virtual hosts. Each host needs its own matching chain, and the settings apply per server block or per listening socket in older versions. Test each name.
• Must-Staple. If a certificate carries the OCSP Must-Staple flag, a failed staple can make the site unreachable in some browsers. Only use it when monitoring is in place.
• Monitoring. Alert if the stapled response is missing or close to expiry. A simple scheduled openssl s_client -status check is enough to begin.

Security note: stapling improves privacy and reliability of revocation checking. It does not replace sound TLS settings, patching or key protection. See how an SSL/TLS certificate works and how SSL/TLS works for the wider picture. Only test servers you own or are authorised to administer.

Next steps

To learn server hardening and web security hands-on, see WebAsha's Linux training and the cyber security course.

Related reading

• How do I fix DNS issues like slow browsing, DNS leaks, or problems caused by DNS over HTTPS (DoH)?
• What is DNS and DNSSEC? Full Guide to How DNS Works and Why DNSSEC Matters in 2026
• Top 6 Server Types You Must Know in 2026 for IT and Cybersecurity | The Detailed Guide