Home / server / Questions / 775101
Accepted
user3448600
Asked: 2016-05-06 10:30:36 +0800 CST

Configuring OCSP stapling in NGINX

  • 772

Should I concatenate all certificates(server + intermediates + root) or just(server + intermediates) for ssl_trusted_certificate directive in NGINX.

nginx ocsp tls

1 Answers

  1. Best Answer

    You should add the following setting

    ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /path/to/root_CA_cert_plus_intermediates;

    to configure OCSP Stapling (the server certificate should not be concatenated here), but you should use ssl_certificate, where the server certificate is provided together with all intermediate certificates:

    ssl_certificate /path/to/signed_cert_plus_intermediates;

    On the other side one should don't include the root_CA_cert here.

    • 1