Enable OCSP Stapling to speed up Browser Response

LinkedIn Facebook Tweet Email

Here we attempt to explain the benefit of OCSP Stapling for SSL Certificate users, and how to enable OCSP Stapling in the easiest manner on Apache, Nginx, and IIS.

Online Certificate Status Protocol (OCSP) was created as an alternative to the Certificate Revocation List (CRL) protocol. Both protocols are used to check whether an SSL Certificate has been revoked.

The Problem…

The problem with the CRL protocol is that it can increase the time spent completing the SSL negotiation. The CRL protocol requires the browser to verify certificate revocation by downloading large amounts of SSL Certificate revocation information, such as certificate serial numbers and status of each certificate’s last publication date, for every https request to the website. Example: CRL list for getssl.in

The OCSP protocol does not require the browser to spend time downloading and then searching a list for certificate information. This is because with OCSP, the browser simply posts a query and receives a response from an OCSP responder.

The OCSP responder is a certifying authority (CA) server that specifically listens for and responds to OCSP requests about the revocation status of a certificate. It can be queried from a client such as a web browser or mobile app (Regular OCSP), or the web server itself (OCSP Stapling).

OCSP Stapling flow — Featured image is courtesy Igor Cicimov’s enlightening blog post

What is OCSP Stapling?

OCSP Stapling is an overlooked setting or configuration that can speed up web browser response time for SSL negotiation with the web server.

This setting lets the web server use the OCSP protocol to be more proactive in improving the client (browsing) experience by:

It allows the certificate presenter (i.e. web server) to query the OCSP responder directly and then securely cache the response. This cached response is then delivered with the TLS/SSL handshake via the Certificate Status Request extension response, so that the web browser gets the same response performance for the certificate status as it does for regular website content.
It addresses a privacy concern with OCSP because the CA does not receive the revocation requests directly from the web browser.
It also addresses concerns about SSL negotiation delays by removing the need for a separate network connection to a CA’s OCSP responders.

Enabling OCSP Stapling

Since OCSP Stapling is a web server enhancement it has to be enabled on the web server. The method varies based on the type of web server platform.

Enabling on Apache httpd web server

OCSP Stapling is supported by Apache httpd server 2.4.x versions onward. You can check the version installed on your machine by running the following command:

apache -v

If OCSP is supported then you need to open the VirtualHost SSL configuration for your website and add two lines.

Add the following line OUTSIDE the <VirtualHost></VirtualHost> block:

SSLStaplingCache shmcb:/tmp/stapling_cache(128000)

Add the following line INSIDE the <VirtualHost></VirtualHost> block:

SSLUseStapling on

As an example here is a sample Virtual Host configuration:

SSLStaplingCache shmcb:/tmp/stapling_cache(128000)
<VirtualHost *:443>
SSLEngine on
SSLProtocol all -SSLv3 -SSLv2
SSLCertificateFile /path/to/yoursite.crt
SSLCertificateKeyFile /path/to/yoursite_private.key
SSLCertificateChainFile /path/to/AnyCABundle.crt
SSLUseStapling on
</VirtualHost>

Finally, reload the Apache httpd server configurations using:

service apache2 reload

You can verify if OCSP Stapling is working by running the follow OpenSSL command:

openssl s_client -connect yoursite.com:443 -status -tlsextdebug < /dev/null 2>&1 | grep -i "OCSP response"

If the OCSP Response Data section contains the following line then OCSP Stapling has been successfully enabled:

OCSP Response Status: successful (0x0)

Enabling on nginx web server

OCSP Stapling is supported by nginx server versions after 1.3.7. You can check the version installed on your machine by running the following command:

nginx -v

If OCSP is supported then you need to add the following directives INSIDE the server { } block:

ssl_stapling on;
ssl_stapling_verify on;

As an example here is a sample server block configuration where certbundle.crt is a single text file with your leaf certificate text content followed by the CA bundle certificate text content:

server
{
listen 443 ssl;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_certificate /etc/ssl/certbundle.crt;
ssl_certificate_key /etc/ssl/yoursite_private.key;
ssl_stapling on;
ssl_stapling_verify on;
}

Finally, restart the nginx server using:

systemctl restart nginx