9 votes
Accepted

Online Certificate Status Protocol (OCSP) and Port 80

OCSP does not have to be on port 80. However, the URL for the OCSP service is specified in the certificates whose validity you are checking; if you want to run it on another port, you need to make ...
Jenny D's user avatar
  • 28.1k
7 votes
Accepted

Do Postfix and Dovecot support OCSP stapling?

As of 2017-10, No. Dovecot does not have any OCSP support whatsoever, as of 2016 was considering the feature for a future release, no work has been done on that since. Postfix does not have any OCSP ...
anx's user avatar
  • 9,728
5 votes
Accepted

nginx: ssl_stapling_verify: What exactly is being verified?

I found in Nginx souce code. the file ngx_event_openssl_stapling.c#L660: OCSP_basic_verify(basic, chain, store,staple->verify ? OCSP_TRUSTOTHER :OCSP_NOVERIFY if you config `ssl_stapling_verify` ...
DailyiOS's user avatar
4 votes
Accepted

Can I make Nginx automatically OCSP staple certificates at reload/restart?

That article explains one way to do it: https://matthiasadler.info/blog/ocsp-stapling-on-nginx-with-comodo-ssl/ The idea is to manually fetch de OCSP response and use the ssl_stapling_file directive. ...
Tom's user avatar
  • 511
4 votes

OpenSSL: how to setup an OCSP server for checking third-party certificates?

In case you are interested: here's my solution. First I ditched OpenSSL's OCSP responder. It can't be used for certificates that have not been created with your self-signed CA. Then I used the ...
StackedCrooked's user avatar
3 votes
Accepted

OCSP setup for Vault

OCSP responder are not handled by Vault. The best you can do is set the URL to some custom OCSP responder calling Vault on the client's behalf with the ocsp_servers parameter in the same API call: ...
ixe013's user avatar
  • 1,066
3 votes

Enabling OCSP stapling on IIS SNI-enabled site

According to Microsoft this behavior is disabled by default, because of potential performance issues. To enable OCSP stapling for SNI and CCS bindings, locate the following registry subkey: "...
Jim Wolff's user avatar
  • 161
3 votes

Revoked certificate is still valid by Google Chrome and Microsoft Edge

Firefox checks CRLs, whereas Chrome/Chromium/Edge does not. The latter use CRLSets instead. There is a good table at the bottom of this article. However it's 18 months old, and as browser security ...
garethTheRed's user avatar
  • 4,779
3 votes
Accepted

Cannot enable OCSP stapling

In the images the properties of the certificate are shown. OCSP Must Staple is a property of the certificate, i.e. that the certificate should only be used together with OCSP stapling - see here for ...
Steffen Ullrich's user avatar
2 votes
Accepted

OCSP Stapling on LAMP with Let's Encrypt

This is a short shell snippet that utilizes openssl: openssl s_client -connect pavelstriz.cz:443 -tls1 -tlsextdebug -status |grep OCSP -A 2 -B 1 You should see something along: OCSP Response ...
M. Glatki's user avatar
  • 2,074
2 votes

Nginx letsencrypt OCSP stappling

nginx is fetching the OCSP response after the first time a request using the respective certificate was made. This behaviour is probably going to be changed in order to fully support OCSP Must Staple ...
anx's user avatar
  • 9,728
2 votes

Nginx letsencrypt OCSP stappling

I don't see anything wrong with your setup, but maybe removing the redundant resolver directive will yield a different result. I've also faced a similar situation, and I've even tested OCSP stapling ...
rad's user avatar
  • 441
2 votes
Accepted

Enabling OCSP stapling on IIS SNI-enabled site

Create a DWORD reg value EnableOcspStaplingForSni under HKLM\System\CurrentControlSet\Control\SecurityProviders\Schannel\ and set it to a non-zero value.
Andrei's user avatar
  • 44
2 votes
Accepted

Why am I unable to make OCSP Stapling work with my nginx, libressl on FreeBSD 12.0-STABLE setup?

FreeBSD security/libressl was recently upgraded to 2.9.1. OCSP stapling has stopped working in nginx for me as well since the version change in LibreSSL, so I'm assuming there is an underlying issue ...
pepe's user avatar
  • 36
2 votes

Best approach to tier 2 PKI with multiple subordinates with ADCS

There is too little information in your initial question. But if you are looking for a clustered solution then keep in mind, that ADCS doesn't support load balancing. ADCS supports two-node server ...
Crypt32's user avatar
  • 6,968
2 votes
Accepted

How to check if a letsencrypt certificate has been revoked

Your input file contains two certificates: the leaf certificate first and the chain certificate second. The chain certificate is the issuer of the leaf certificate so it needs to be used for the -...
Steffen Ullrich's user avatar
2 votes
Accepted

Apache httpd: How to enable OCSP stapling with mod_md?

It seems that in older versions of mod_md you have to use: <MDomainSet> if you make it a container directive. OCSP stapling however only made its appearance in mod_md version 2.1.0 and can only ...
Gerrit's user avatar
  • 1,572
2 votes
Accepted

Check OCSP on Linux with GET method

You need to add the -no_nonce option to OpenSSL. Microsoft OCSP server doesn't support nonce in the requests.
garethTheRed's user avatar
  • 4,779
1 vote

How to setup the OCSP responder

How to setup the OCSP responder? Wikipedia lists several OSCP responder implementations here. Each server will have their own specific installation and configuration instructions. For testing ...
HBruijn's user avatar
  • 80.3k
1 vote
Accepted

How does OCSP handle deleted certificates?

Will the Microsoft OCSP Responder validate the serial number against the CA database as well as its revocation status? by default, Microsoft OCSP will report such serial number as "Good". ...
Crypt32's user avatar
  • 6,968
1 vote
Accepted

Windows: How can I diagnose certificate revocation check failure, when I know the OK response is sent?

The certutil.exe has a relatively new option, called -downloadocsp which you can use to verify the OCSP responses. In a command prompt, create two folders, called certs and results. Place your ...
garethTheRed's user avatar
  • 4,779
1 vote

How to check if a letsencrypt certificate has been revoked

Besides Steffen's answer using OCSP you can also use Certificate Transparency Logs search interfaces, that store all certificates, and their revocation status, from any public CA. If you search with ...
Patrick Mevzek's user avatar
1 vote
Accepted

"Next Update" is missing from the OCSP response

From section 4.2.2.1 of RFC 6960 - X.509 Internet Public Key Infrastructure Online Certificate Status Protocol - OCSP: If nextUpdate is not set, the responder is indicating that newer revocation ...
garethTheRed's user avatar
  • 4,779
1 vote

nginx: ssl_stapling_verify: What exactly is being verified?

Wikipedia says, "OCSP stapling, formally known as the TLS Certificate Status Request extension, is an alternative approach to the Online Certificate Status Protocol (OCSP) for checking the revocation ...
Diogenes deLight's user avatar
1 vote

Using Apache as Stunnel

Turns out this was an error on my part in one the VirtualHost for 443. This is what it looked like: <VirtualHost *:443 *:7232> # Configurations go here! </VirtualHost> Because ...
Vivek Joshy's user avatar
1 vote
Accepted

How to build an OCSP certificate chain for dual-stack RSA + ECC certificates

I did a quick research, and it seems the easiest answer to this "you don't build it" and it will just work :) OSCP stapling may work fine without ssl_trusted certificate as long as.. Your OS trusted ...
Danila Vershinin's user avatar
1 vote

StrongswanPKI - Adding status_request or MustStaple TLS extension to certificate?

The X.509 extension you refer to is actually called "TLS feature extension" and is defined in RFC 7633. If defined, it contains a list of TLS extension identifiers of which one might be ...
ecdsa's user avatar
  • 4,103
1 vote
Accepted

Strongswan PKI - ED25519 Certifcates - OCSP Responder having issues

If you used strongSwan's pki tool to create your CA there won't be any index.txt file that OpenSSL needs for it's OCSP server. OpenSSL creates and modifies these index "database" files when issuing/...
ecdsa's user avatar
  • 4,103
1 vote
Accepted

nginx OCSP stapling centos let's encrypt

For anyone wondering... ssl_stapling on; ssl_trusted_certificate /etc/letsencrypt/live/DOMAIN/chain.pem; #ssl_stapling_verify on; note the hash, by having no verify it actually works: on the ...
Misterr Moron's user avatar
1 vote
Accepted

OCSP with nginx is unable to get issuer certificate

Thanks for all the comments! It made me look carefully at the certificate chains again and I noticed I did not put the root CA certificate into the file root_ca_and_intermediate.pem but the ...
David K's user avatar
  • 41

Only top scored, non community-wiki answers of a minimum length are eligible