Should I concatenate all certificates(server + intermediates + root) or just(server + intermediates) for ssl_trusted_certificate directive in NGINX.

  • You should show what you did up until now to solve this on your own. – gf_ May 5 '16 at 20:42

You should add the following setting

ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /path/to/root_CA_cert_plus_intermediates;

to configure OCSP Stapling (the server certificate should not be concatenated here), but you should use ssl_certificate, where the server certificate is provided together with all intermediate certificates:

ssl_certificate /path/to/signed_cert_plus_intermediates;

On the other side one should don't include the root_CA_cert here.

  • So for OCSP intermediate certs + root only. I know about other things. – user3448600 May 6 '16 at 5:52
  • Ah, and I forgot, what order for ssl_trusted_certificate root + intermediate or intermediate + root. Please edit your answer when you can. – user3448600 May 6 '16 at 6:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.