This is an old revision of the document!


OCSP Stapling

Online Certificate Status Protocol (OCSP) was created as an alternative to the Certificate Revocation List (CRL) protocol. Both protocols are used to check whether an SSL Certificate has been revoked. The OCSP protocol does not require the browser to spend time downloading and then searching a list for certificate information. With OCSP, the browser simply posts a query and receives a response from an OCSP responder (a CA’s server that specifically listens for and responds to OCSP requests) about the revocation status of a certificate.

OCSP stapling can be used to enhance the OCSP protocol by letting the webhosting site be more proactive in improving the client (browsing) experience. OCSP stapling allows the certificate presenter (i.e. web server) to query the OCSP responder directly and then cache the response. This securely cached response is then delivered with the TLS/SSL handshake via the Certificate Status Request extension response, ensuring that the browser gets the same response performance for the certificate status as it does for the website content.

This article explains how to set up OCSP stapling. OCSP stapling speeds up the SSL verification process by attaching a pre-approved certificate to the SSL handshake response. This streamlines the process and removes burdens from the client and SSL certification authorities. For more information on OCSP stapling, see our blog.

This article assumes that you already have the necessary certificate files and an OCSP responder. OCSP stapling is only available for LiteSpeed Web Server 4.2.4 and above.

For 4.2.x and 5.0.x version, it can only be setup from LiteSpeed native configuration and not able to be set up through Apache configuration, such as httpd.conf file. If the virtual host configurations are setup on both Apache conf and LiteSpeed natively, the native vhost can not override the vhost from Apache, as Apache vhosts are configured after the native vhosts, which may override the LiteSpeed native vhost settings. The corresponding vhost settings in Apache conf have to be removed.

However, 5.1.x and above have added SSL OCSP Stapling support through Apache httpd.conf.

Follow the same way as Apache through httpd.conf. Apache supports OCSP stapling in Apache HTTPD Server 2.3.3+. Some external reference such as this one or the other

Edit your site’s VirtualHost SSL configuration.

Add the following line INSIDE the <VirtualHost></VirtualHost> block:

SSLUseStapling on

Add the following line OUTSIDE the <VirtualHost></VirtualHost> block:

SSLStaplingCache shmcb:/tmp/stapling_cache(128000)

For example:

SSLStaplingCache shmcb:/tmp/stapling_cache(128000)
<VirtualHost *:443>
 SSLEngine on
 SSLProtocol all -SSLv3 -SSLv2
 SSLCertificateFile /path/to/your_domain_name.crt
 SSLCertificateKeyFile /path/to/your_private.key
 SSLCertificateChainFile /path/to/DigiCertCA.crt
 SSLUseStapling on
</VirtualHost>

Set up a secure listener

Add a listener (WebAdmin console > Configuration > Listeners > Add).

Make sure you click Yes under the Secure setting. (The other settings should be customized to listen to the correct IP and port for the virtual hosts this listener will be mapping to.)

Set up certificate files

Open up the listener again (View/Edit).

Under the SSL tab, enter the paths and locations for your certificates and key files.

Set the OCSP values

To set up OCSP stapling, you must set Enable OCSP Stapling to “Yes”. It is also better to put the address of your OCSP responder in the OCSP Responder field (though the server may be able to find it in your CA certificate). Check with your certificate authority (CA) for your OCSP responder's address.

Graceful restart to apply changes

Method 1:

Check in $SERVER_ROOT/temp/ocspcache/. If a file has been created there, then your OCSP stapling is working. If not, check your error logs for what went wrong.

Method 2:

openssl s_client -connect $Your_Domain:443 -status

If OCSP stapling is working, it will show ok

  • Admin
  • Last modified: 2017/09/11 17:55
  • by Eric Leu