How to turn off stapling and must staple using apache?

Help
1

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is:
www.rrm.me.uk
I ran this command:

It produced this output:

My web server is (include version):
Apache 2.4.62
The operating system my web server runs on is (include version):
Debain bookworm
My hosting provider, if applicable, is:

I can login to a root shell on my machine (yes or no, or I don't know):
yes
I'm using a control panel to manage my site (no, or provide the name and version of the control panel):
no
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):
certbot 2.1.0

Given that OCSP Stapling is going away, how can I get a new certificate that does not include stapling?

The message from LetsEncrypt says "To ensure your certificates continue to automatically renew, please change your ACME client configuration to not request OCSP Must Staple."

How, exactly does one do that? I tried editing my /etc/letsencrypt/renewal/domain.conf file to set must_staple = False, then requested a certifcate renewal, but the certificate renewal came back with must_staple reset to True again. I also tried deleting this line and the same happened.

2

Do you have a cli.ini in /etc/letsencrypt that specifies must-staple?

Because it does sound strange that Certbot would restore that setting even if removed from the renewal profile. I am not sure False works but when not used nothing appears in the renewal profile.

Also note your Apache is not stapling today. Your cert says must-staple, but, your Apache just isn't doing it. And, browsers tend not to care so you may not have noticed it.

See: SSL Server Test: www.rrm.me.uk (Powered by Qualys SSL Labs)

2 Likes
3

Yes, I had a cli.ini. After I edited that too, I was able to get a certificate without must-staple.

Just for the record, visitors to my website using Firefox were getting errors with the must-staple cert with stapling turned off.

Thanks for the help!

1 Like
4

Glad you got it working.

Yeah, Firefox would show error. But, Chrome, Edge, Opera and Safari (at least the iPad version) would not care you did not staple the Must-Staple cert.

1 Like