Questions[ocsp](server)

Since I would like to set the "must staple" attribute in my SSL certificates, I was doing some research to find out if all of my services support OCSP stapling. So far I found out, that Apache does which I was able to confirm using SSLLabs.com.

But apart from that, I wasn't able to confirm, if my two other services (SMTP and IMAP) also support OCSP stapling. Now my question is, do Postfix and Dovecot also support it?

PS: I know that certificates don't seem to be crucial when it comes to mail transport, but I would like to avoid any possible issues, if I do add the attribute and a client might refuse to work because of that, while others could benefit from it.

Is there a way to make Nginx proactively OCSP staple certificates each time its configuration is reloaded or it is re-started? Alternatively, can Nginx be set to save the stapled certificates across reloads or restarts instead of discarding them? Reloading or restarting Nginx appears to clear all cached OCSP stapled certificates.

I have OSCP stapling tested and working on an Ubuntu 16.04.1 server running Nginx 1.11.4 and using Certbot's OCSP Must-Staple TLS feature extension. My problem is that upon reload or restart of Nginx, the stapled response is not saved and the first visitor sees an error page instead (this is the expected outcome for "must staple" certs not yet stapled by the server).

I have to visit each website hosted by the server and reload them a couple times while Nginx automagically OCSP staples the certificates, then everything starts working again until the next restart. I'd like to automate this step or avoid it altogether.

If Require Server Name Indication is checked on the binding of an IIS site, OCSP stapling is disabled for the site.

This is easily confirmed by enabling SNI for a site that currently doesn't require it, and checking using https://www.ssllabs.com/ssltest/ or openssl:

openssl s_client -connect foobar.com:443 -servername foobar.com -tls1 -tlsextdebug -status

Does anyone have a workaround for this so that clients of SNI-enabled sites can enjoy the benefits of OCSP stapling?

I am testing the Certificate Revocation functionality of a CMTS device. This requires me to setup a OCSP responder. Since it will only be used for testing I assume that the minimal implementation provided by OpenSSL should suffice.

I have extracted the a certificate from a cable modem, copied it to my PC and converted it to the PEM format. Now I want to register it in the OpenSSL OCSP database and start a server.

I have completed all these steps, but when I do a client request my server invariably responds with "unknown". It seems to be completely unaware of my certificate's existence.

I would greatly appreciate if anyone would be willing to have a look at my code. For your convenience, I have created a single script consisting of a sequential list of all used commands, from setting up the CA until starting the server: http://code.google.com/p/stacked-crooked/source/browse/trunk/Misc/OpenSSL/AllCommands.sh

You can also find the custom config file and the certificate that I am testing with: http://code.google.com/p/stacked-crooked/source/browse/trunk/Misc/OpenSSL/

Any help would be greatly appreciated.

Can anyone recommend a free and simple OCSP server for Windows or Linux?