Should I concatenate all certificates(server + intermediates + root) or just(server + intermediates) for ssl_trusted_certificate
directive in NGINX.
1 Answer
You should add the following setting
ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /path/to/root_CA_cert_plus_intermediates;
to configure OCSP Stapling (the server certificate should not be concatenated here), but you should use ssl_certificate
, where the server certificate is provided together with all intermediate certificates:
ssl_certificate /path/to/signed_cert_plus_intermediates;
On the other side one should don't include the root_CA_cert
here.
-
So for OCSP intermediate certs + root only. I know about other things. May 6, 2016 at 5:52
-
Ah, and I forgot, what order for
ssl_trusted_certificate
root + intermediate or intermediate + root. Please edit your answer when you can. May 6, 2016 at 6:06