On centos, but I guess for every OS, I want to make ocsp stapling work in Nginx

ssl_stapling on;
ssl_trusted_certificate  ??????; 
ssl_stapling_verify on;

what do I define for ssl_trusted_certificate? People talk about "chain+root file" or root.ca, but it's very unclear to me if these files are already on my server or where to find/create them.

I have a valid certificate from Let's Encrypt and SSL/TLS (https) is working fine already. But how do I go from here?

1 Answer 1


For anyone wondering...

ssl_stapling on;
ssl_trusted_certificate  /etc/letsencrypt/live/DOMAIN/chain.pem;
#ssl_stapling_verify on;

note the hash, by having no verify it actually works:

on the command line: openssl s_client -connect DOMAIN:443 -tls1 -tlsextdebug -status |grep OCSP -A 2 -B 1

OCSP response:
OCSP Response Data:
    OCSP Response Status: successful (0x0)
    Response Type: Basic OCSP Response
    Version: 1 (0x0)
    Responder Id: C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.