Should I concatenate all certificates(server + intermediates + root) or just(server + intermediates) for ssl_trusted_certificate directive in NGINX.

  • You should show what you did up until now to solve this on your own.
    – gxx
    May 5, 2016 at 20:42

1 Answer 1


You should add the following setting

ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /path/to/root_CA_cert_plus_intermediates;

to configure OCSP Stapling (the server certificate should not be concatenated here), but you should use ssl_certificate, where the server certificate is provided together with all intermediate certificates:

ssl_certificate /path/to/signed_cert_plus_intermediates;

On the other side one should don't include the root_CA_cert here.

  • So for OCSP intermediate certs + root only. I know about other things. May 6, 2016 at 5:52
  • Ah, and I forgot, what order for ssl_trusted_certificate root + intermediate or intermediate + root. Please edit your answer when you can. May 6, 2016 at 6:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.