# Manual OCSP Stapling

**URL:** <https://community.letsencrypt.org/t/manual-ocsp-stapling/10907>\
**Category:** Server\
**Created:** [February 16, 2016, 6:40am UTC](https://community.letsencrypt.org/t/manual-ocsp-stapling/10907 "2016-02-16T06:40:06Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jason](https://avatars.discourse-cdn.com/v4/letter/j/dc4da7/32.png) [@Jason](https://community.letsencrypt.org/u/Jason)\
**Post date:** [February 16, 2016, 6:40am UTC](https://community.letsencrypt.org/t/manual-ocsp-stapling/10907/1 "2016-02-16T06:40:06Z")

</div>

Is there any way to force Apache to fetch a fresh OCSP response from the Let’s Encrypt OCSP responder manually?

---

<div class="post-metadata">

**Author:** ![mrtux](https://avatars.discourse-cdn.com/v4/letter/m/9de0a6/32.png) [@mrtux](https://community.letsencrypt.org/u/mrtux)\
**Post date:** [February 16, 2016, 1:24pm UTC](https://community.letsencrypt.org/t/manual-ocsp-stapling/10907/2 "2016-02-16T13:24:14Z")

</div>

Restarting did the track for me. But be aware, that the Let’sEncrypt OCSP responses are valid for four days and seem to be pre-generated (i.e., re-downloading it does not give you a fresh OCSP response).

---

<div class="post-metadata">

**Author:** ![Troon](https://avatars.discourse-cdn.com/v4/letter/t/839c29/32.png) [@Troon](https://community.letsencrypt.org/u/Troon)\
**Post date:** [February 19, 2016, 11:45am UTC](https://community.letsencrypt.org/t/manual-ocsp-stapling/10907/3 "2016-02-19T11:45:50Z")

</div>

See my response here:

> [@Will/does the letsencrypt client create a cert chain usable with OCSP stapling?](https://community.letsencrypt.org/t/will-does-the-letsencrypt-client-create-a-cert-chain-usable-with-ocsp-stapling/2072/19):
>
> I…

I use nginx not Apache, but should be transferrable — the actual fetching is not done by the web server. Works really well here.

---

<div class="post-metadata">

**Author:** ![Jason](https://avatars.discourse-cdn.com/v4/letter/j/dc4da7/32.png) [@Jason](https://community.letsencrypt.org/u/Jason)\
**Post date:** [February 19, 2016, 7:29pm UTC](https://community.letsencrypt.org/t/manual-ocsp-stapling/10907/4 "2016-02-19T19:29:30Z")

</div>

Well, the SSL Stapling Cache on my Apache server is “shmcb” (which uses “shared memory segments”) so the OCSP response is never stored on the disk. Therefore, (Apache on its website warns users that change the shmcb of possible performance penalty when there are many users) how can I do that one here, maybe forcing Apache to load a pre-fetched disk file on this “shared memory segment” when OCSP doesn’t respond?

---

<div class="post-metadata">

**Author:** ![jsha](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jsha/32/12_2.png) [@jsha](https://community.letsencrypt.org/u/jsha)\
**Post date:** [February 19, 2016, 8:16pm UTC](https://community.letsencrypt.org/t/manual-ocsp-stapling/10907/5 "2016-02-19T20:16:50Z")

</div>

Unfortunately no. Apache’s current behavior is to do a blocking fetch when it needs to update. See [gist.github.com/sleevi/5efe9ef98961ecfb4da8](http://gist.github.com/sleevi/5efe9ef98961ecfb4da8) for some details of what needs to be fixed.