# Apache - robust OCSP stapling config **URL:** \ **Category:** Help\ **Created:** [August 6, 2018, 10:09am UTC](https://community.letsencrypt.org/t/apache-robust-ocsp-stapling-config/68628 "2018-08-06T10:09:30Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![futureweb](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/futureweb/32/69239_2.png) [@futureweb](https://community.letsencrypt.org/u/futureweb)\ **Post date:** [August 6, 2018, 10:09am UTC](https://community.letsencrypt.org/t/apache-robust-ocsp-stapling-config/68628/1 "2018-08-06T10:09:30Z")
Hey there, since the “[letsencryot.org](http://letsencryot.org)” [DNS Troubles](https://community.letsencrypt.org/t/ocsp-responder-problems-letsencrypt-org-dns-problem/68046) last week also cought our Web-Servers offhand I’m going to try to optimize OCSP configuration on our Apache Servers. Currently I got this config: ``` SSLUseStapling on SSLStaplingResponderTimeout 5 SSLStaplingStandardCacheTimeout 259200 SSLStaplingErrorCacheTimeout 1200 SSLStaplingReturnResponderErrors off SSLStaplingCache shmcb:/run/httpd/ssl_stapling(512000) ``` Already googled / browsed the Boards - but didn’t really find any good suggestions on how to configure Apache Stapling to be more robust … Is there any possibility to tell Apache to re-fetch/validate Response 1 day before the cache is going to expire? Or are there any other suggestions on how to configure robust OCSP Stapling in Apache? Thank you, bye from Austria Andreas ---
**Author:** ![futureweb](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/futureweb/32/69239_2.png) [@futureweb](https://community.letsencrypt.org/u/futureweb)\ **Post date:** [August 20, 2018, 9:36am UTC](https://community.letsencrypt.org/t/apache-robust-ocsp-stapling-config/68628/2 "2018-08-20T09:36:50Z")
noone? nothing? 🤐 ---
**Author:** ![cpu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/cpu/32/84514_2.png) [@cpu](https://community.letsencrypt.org/u/cpu)\ **Post date:** [August 20, 2018, 1:58pm UTC](https://community.letsencrypt.org/t/apache-robust-ocsp-stapling-config/68628/3 "2018-08-20T13:58:30Z")
Maybe @icing would have thoughts on this? (Apologies if you don’t, I’m guessing based on your `mod_md` experience you might or could direct the question to a subject matter expert) ---
**Author:** ![tdelmas](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/tdelmas/32/1866_2.png) [@tdelmas](https://community.letsencrypt.org/u/tdelmas)\ **Post date:** [August 20, 2018, 2:52pm UTC](https://community.letsencrypt.org/t/apache-robust-ocsp-stapling-config/68628/4 "2018-08-20T14:52:14Z")
I guess you already saw @hannob's blog post (from June 27, 2018): [https://blog.hboeck.de/archives/886-The-Problem-with-OCSP-Stapling-and-Must-Staple-and-why-Certificate-Revocation-is-still-broken.html](https://blog.hboeck.de/archives/886-The-Problem-with-OCSP-Stapling-and-Must-Staple-and-why-Certificate-Revocation-is-still-broken.html) > There’s currently no way to configure Apache to handle OCSP stapling in a reasonable way ---
**Author:** ![icing](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/icing/32/25691_2.png) [@icing](https://community.letsencrypt.org/u/icing)\ **Post date:** [August 27, 2018, 9:04am UTC](https://community.letsencrypt.org/t/apache-robust-ocsp-stapling-config/68628/5 "2018-08-27T09:04:50Z")
As written in the blog by @hannob, the OCSP implementation in Apache is not its strongest point. I agree with his recommendations. Beside those, I would recommend using a persistent cache, so stapling responses survive reloads. Something like: ```auto SSLStaplingCache dbm:ocsp-stapling ``` ---
**Author:** ![joohoi](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/joohoi/32/9730_2.png) [@joohoi](https://community.letsencrypt.org/u/joohoi)\ **Post date:** [August 27, 2018, 11:46am UTC](https://community.letsencrypt.org/t/apache-robust-ocsp-stapling-config/68628/6 "2018-08-27T11:46:02Z")
Unfortunately Apache nukes the OCSP stapling cache upon restarts even when using on-disk dbm cache files. I attempted to tackle the issue of OCSP response caching, prefetching and dbm preservance in Certbot Apache plugin but it turns out that the underlying dbm engine flavor gets decided at compile time, and I’m seeing a lot of variance in precompiled Apache packages of different Linux distributions. In some distros the selected dbm format is also one that isn’t supported by Python dbm module. I’m still investigating if there’s a way to make this work, but it doesn’t look too good. ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [September 26, 2018, 11:46am UTC](https://community.letsencrypt.org/t/apache-robust-ocsp-stapling-config/68628/7 "2018-09-26T11:46:05Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.