Determining how removal of OCSP affects me

Help
1

My domain is: chrishaberman.me

I ran this command: n/a

It produced this output: n/a

My web server is (include version): NGINX 1.22.1-9

The operating system my web server runs on is (include version): Raspbian (Debian) 12

My hosting provider, if applicable, is:

I can login to a root shell on my machine (yes or no, or I don't know): Yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): No

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): 3.1.0

I do NOT have OCSP Must-Staple on but my current certificate does allow stapling (from my nginx ssl config):

ssl_stapling on;
ssl_stapling_verify on;

image
image870×167 6.27 KB

Do I need to disable stapling all together in nginx to be prepared for the transition outlined on the blog post? Or is this just something that will change in the certificate itself as your changes are implemented?

Do I need to do anything to my nginx config to be sure CRL's are supported?

1 Like
2

Ok It took me a bunch of different queries to finally dig up a thread that covers this (my google-fu is struggling today). It sounds like I shouldn't need to do anything. When OCSP is removed NGINX might produce a warning in the logs if I leave stapling on in the SSL config but it shouldn't break anything.

3 Likes