<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:1870949526;
mso-list-type:hybrid;
mso-list-template-ids:-625595546 67698703 67698713 67698715 67698703 67698713 67698715 67698703 67698713 67698715;}
@list l0:level1
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level2
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level3
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l0:level4
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level5
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level6
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l0:level7
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level8
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level9
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal>One of the agenda items we discussed at the face-to-face was the poor adoption of OCSP stapling in Apache and nginx because it is not turned on by default. While it would be great if Apache and nginx could just turn on OCSP stapling by default, to move this forward we should post instructions on the web site for configuring OCSP stapling manually on these platforms. <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Here are the beginnings of a web page on implementing OCSP stapling. (Or we could figure out how to leverage these pages by Remy van Elst - <a href="https://raymii.org/s/tutorials/OCSP_Stapling_on_Apache2.html">https://raymii.org/s/tutorials/OCSP_Stapling_on_Apache2.html</a> and <a href="https://raymii.org/s/tutorials/OCSP_Stapling_on_nginx.html">https://raymii.org/s/tutorials/OCSP_Stapling_on_nginx.html</a>, or by someone else.) <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><b>What is OCSP Stapling?</b><o:p></o:p></p><p class=MsoNormal>The Online Certificate Status Protocol (OCSP) is a method that clients (browsers and operating systems) use to obtain the validity status of an X.509 digital certificate. OCSP without stapling requires that the client make an additional request during its TLS handshake with the server in order to obtain that certificate status. OCSP stapling allows the server to pre-fetch and cache the OCSP response and deliver it to the client whenever the client indicates that it supports OCSP stapling. OCSP stapling results in faster page loads and increases privacy because the client does not need to communicate with the CA about its site visits. <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><b>How do I enable OCSP Stapling?<o:p></o:p></b></p><p class=MsoNormal>OCSP stapling is currently supported by default in IIS 7+, but if you are using Apache 2.4+ or Nginx 1.7.3+, you can also enable OCSP stapling relatively easily by adding a few directives to your server’s configuration file(s). If you operate in a more complex, shared, or load-balanced system, then the following instructions may not suffice. <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Also, make sure that your server can make an outbound connection to your CA’s OCSP responder(s) by configuring your hosts table, firewall ports, etc., and then test for connectivity and retrieval of OCSP responses by your server. <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><table class=MsoTableGrid border=1 cellspacing=0 cellpadding=0 style='border-collapse:collapse;border:none'><tr><td width=307 valign=top style='width:184.2pt;border:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><o:p> </o:p></p></td><td width=499 valign=top style='width:299.25pt;border:solid windowtext 1.0pt;border-left:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><b>Apache 2.4+<o:p></o:p></b></p></td><td width=499 valign=top style='width:299.25pt;border:solid windowtext 1.0pt;border-left:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><b>Nginx 1.7.3+<o:p></o:p></b></p></td></tr><tr><td width=307 valign=top style='width:184.2pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>Check your version<o:p></o:p></p></td><td width=499 valign=top style='width:299.25pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>apache2 -v<o:p></o:p></p></td><td width=499 valign=top style='width:299.25pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>nginx -v<o:p></o:p></p></td></tr><tr><td width=307 valign=top style='width:184.2pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>File to modify<o:p></o:p></p></td><td width=499 valign=top style='width:299.25pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>Virtual Host (or conf in sites-enabled if no virtual hosts are used)<o:p></o:p></p></td><td width=499 valign=top style='width:299.25pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>nginx.conf<o:p></o:p></p></td></tr><tr><td width=307 valign=top style='width:184.2pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>Edit configuration file<o:p></o:p></p><p class=MsoNormal>(CentOS/Fedora users replace apache2 with httpd)<o:p></o:p></p></td><td width=499 valign=top style='width:299.25pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>sudo nano /etc/apache2/sites-enabled/example.com-ssl.conf<o:p></o:p></p></td><td width=499 valign=top style='width:299.25pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>sudo nano /etc/nginx/ssl/nginx.conf<o:p></o:p></p><p class=MsoNormal>sudo nano /etc/nginx/sites-enabled/example.com.ssl<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>server {<o:p></o:p></p></td></tr><tr><td width=307 valign=top style='width:184.2pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal># listen on port 443<o:p></o:p></p></td><td width=499 valign=top style='width:299.25pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal> VirtualHost _default_:443<o:p></o:p></p></td><td width=499 valign=top style='width:299.25pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal> listen 443; …<o:p></o:p></p></td></tr><tr><td width=307 valign=top style='width:184.2pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal># turn on SSL<o:p></o:p></p></td><td width=499 valign=top style='width:299.25pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal> SSLEngine on …<o:p></o:p></p></td><td width=499 valign=top style='width:299.25pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal> ssl on; …<o:p></o:p></p></td></tr><tr><td width=307 valign=top style='width:184.2pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal># enable ocsp stapling<o:p></o:p></p></td><td width=499 valign=top style='width:299.25pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal> SSLUseStapling on<o:p></o:p></p></td><td width=499 valign=top style='width:299.25pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal> ssl_stapling on;<o:p></o:p></p></td></tr><tr><td width=307 valign=top style='width:184.2pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal># point to DNS server <o:p></o:p></p></td><td width=499 valign=top style='width:299.25pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><o:p> </o:p></p></td><td width=499 valign=top style='width:299.25pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal> resolver 192.168.1.1;<o:p></o:p></p></td></tr><tr><td width=307 valign=top style='width:184.2pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal># enable server to check OCSP<o:p></o:p></p></td><td width=499 valign=top style='width:299.25pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><o:p> </o:p></p></td><td width=499 valign=top style='width:299.25pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal> ssl_stapling_verify on;<o:p></o:p></p></td></tr><tr><td width=307 valign=top style='width:184.2pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal># set seconds to wait for OCSP response from CA<o:p></o:p></p></td><td width=499 valign=top style='width:299.25pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>SSLStaplingResponderTimeout 5<o:p></o:p></p></td><td width=499 valign=top style='width:299.25pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal># the ssl_stapling_verify directive requires a fully trusted certificate chain as specified in the ssl_trusted_certificate<o:p></o:p></p><p class=MsoNormal>directive below<o:p></o:p></p></td></tr><tr><td width=307 valign=top style='width:184.2pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal># prevent user error messages<o:p></o:p></p></td><td width=499 valign=top style='width:299.25pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>SSLStaplingReturnResponderErrors off<o:p></o:p></p></td><td width=499 valign=top style='width:299.25pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><o:p> </o:p></p></td></tr><tr><td width=307 valign=top style='width:184.2pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal># point to trusted certificate chain PEM file (all certificates- root, intermediate, and server)<o:p></o:p></p></td><td width=499 valign=top style='width:299.25pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>SSLCACertificateFile /etc/ssl/apache2/my_ca.crt<o:p></o:p></p></td><td width=499 valign=top style='width:299.25pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>ssl_trusted_certificate /etc/nginx/ssl/mysite.crt;<o:p></o:p></p></td></tr><tr><td width=307 valign=top style='width:184.2pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal># specify cached response location<o:p></o:p></p></td><td width=499 valign=top style='width:299.25pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>SSLStaplingCache shmcb:/var/run/ocsp(128000)<o:p></o:p></p></td><td width=499 valign=top style='width:299.25pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>ssl_stapling_file ocsp_response;<o:p></o:p></p></td></tr><tr><td width=806 colspan=2 valign=top style='width:483.45pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal># SSLStaplingCache must point to location outside of VirtualHost folder or Apache will not start<o:p></o:p></p></td><td width=499 valign=top style='width:299.25pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>}<o:p></o:p></p></td></tr><tr><td width=307 valign=top style='width:184.2pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>Test before reloading<o:p></o:p></p></td><td width=499 valign=top style='width:299.25pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>apachectl -t<o:p></o:p></p></td><td width=499 valign=top style='width:299.25pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>service nginx configtest<o:p></o:p></p></td></tr><tr><td width=307 valign=top style='width:184.2pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>Restart if OK<o:p></o:p></p></td><td width=499 valign=top style='width:299.25pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>service apache2 reload<o:p></o:p></p></td><td width=499 valign=top style='width:299.25pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal>nginx -s reload<o:p></o:p></p></td></tr></table><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><b>For </b>additional <b>Apache</b> configuration options, see <a href="http://httpd.apache.org/docs/trunk/mod/mod_ssl.html">http://httpd.apache.org/docs/trunk/mod/mod_ssl.html</a> <o:p></o:p></p><p class=MsoNormal><b>For </b>additional<b> nginx </b>configuration options, see <a href="http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_stapling">http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_stapling</a> and <a href="http://nginx.com/wp-content/uploads/2014/03/nginx-modules-reference-r3.pdf">http://nginx.com/wp-content/uploads/2014/03/nginx-modules-reference-r3.pdf</a>.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p></div></body></html>