Is this possible to achieve?
I'm using this Nginx package built with Quic module. I configure it as described there except for the Stapling part because I'm not able to generate the ocsp file. Maybe is it for this reason it doesn't work? Is Stapling mandatory using HTTP/3 protocol?
ssl_stapling on;
ssl_stapling_file /path/to/ocsp; # generate by `openssl ocsp -no_nonce -issuer /path/to/intermediate -cert /path/to/cert -url "$(openssl x509 -in /path/to/cert -noout -ocsp_uri)" -respout /path/to/ocsp`
Using HTTP/2 no problem at all.
Using HTTP/3 Chrome returns NET::ERR_CERT_INVALID. Same on Firefox.
My domain is: https://dev.tecnicman.com/
I ran this command to acquire and install the certificate:
certbot -i nginx --dns-cloudflare --dns-cloudflare-credentials cloudflare.ini -d dev.tecnicman.com
My web server is (include version):
nginx version: nginx/1.23.0
built with OpenSSL 1.1.1 (compatible; BoringSSL) (running with BoringSSL)
TLS SNI support enabled
configure arguments: --prefix=/etc/nginx --sbin-path=/usr/sbin/nginx --add-module=/github/home/nginx/debian/modules/ngx_brotli --add-module=/github/home/nginx/debian/modules/headers-more-nginx-module --add-module=/github/home/nginx/debian/modules/ngx_http_geoip2_module --modules-path=/usr/lib/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --pid-path=/var/run/nginx.pid --lock-path=/var/run/nginx.lock --http-client-body-temp-path=/var/cache/nginx/client_temp --http-proxy-temp-path=/var/cache/nginx/proxy_temp --http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp --user=nginx --group=nginx --with-file-aio --with-threads --with-http_ssl_module --with-http_v2_module --with-http_v3_module --without-select_module --without-poll_module --without-http_access_module --without-http_autoindex_module --without-http_browser_module --without-http_charset_module --without-http_empty_gif_module --without-http_limit_conn_module --without-http_memcached_module --without-http_mirror_module --without-http_referer_module --without-http_split_clients_module --without-http_scgi_module --without-http_ssi_module --without-http_upstream_hash_module --without-http_upstream_ip_hash_module --without-http_upstream_keepalive_module --without-http_upstream_least_conn_module --without-http_upstream_random_module --without-http_upstream_zone_module --without-http_userid_module --without-http_uwsgi_module --with-zlib=/github/home/nginx/debian/modules/zlib --with-cc-opt='-I../modules/boringssl/include -g -O2 -ffile-prefix-map=/github/home/nginx=. -fstack-protector-strong -Wformat -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -fPIC' --with-ld-opt='-ljemalloc -L../modules/boringssl/build/ssl -L../modules/boringssl/build/crypto -Wl,-z,relro -Wl,-z,now -Wl,--as-needed -pie'
The operating system my web server runs on is (include version):
Distributor ID: Ubuntu
Description: Ubuntu 22.04 LTS
Release: 22.04
Codename: jammy
My hosting provider, if applicable, is: Not applicable
I can login to a root shell on my machine (yes or no, or I donāt know): Yes
Iām using a control panel to manage my site (no, or provide the name and version of the control panel): No
The version of my client is (e.g. output of certbot --version or certbot-auto --version if youāre using Certbot):
certbot 1.29.0
CONFIGURATION
nginx.conf
user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log notice;
pid /var/run/nginx.pid;
events {
use epoll;
worker_connections 1024;
multi_accept on;
}
http {
include /etc/nginx/mime.types;
default_type application/octet-stream;
##
# Logging Settings
##
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
##
# Basic Settings
##
aio threads;
aio_write on;
brotli on;
brotli_types application/atom+xml application/javascript application/json application/rss+xml
application/vnd.ms-fontobject application/x-font-opentype application/x-font-truetype
application/x-font-ttf application/x-javascr>
etag off;
gzip on;
gzip_comp_level 6;
gzip_types application/atom+xml application/javascript application/json application/rss+xml
application/vnd.ms-fontobject application/x-font-opentype application/x-font-truetype
application/x-font-ttf application/x-javascrip>
more_clear_headers server;
quic_gso on;
quic_retry on;
sendfile on;
tcp_nopush on;
include /etc/nginx/security-headers.conf;
include /etc/nginx/conf.d/*.conf;
}
security-headers.conf
# Hide from Header Server Name (nginx) (on to enable default)
server_tokens off;
# Security Headers
add_header X-Frame-Options DENY;
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block";
# HSTS (HTTP Strict Transport Security)
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
ssl-params.conf
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:10m;
ssl_buffer_size 1400;
ssl_session_tickets off;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305;
ssl_prefer_server_ciphers off;
ssl_ecdh_curve secp384r1;
ssl_dhparam /etc/nginx/dhparam.pem;
#ssl_stapling on;
#ssl_stapling_verify on;
#ssl_stapling_file /etc/nginx/isrg-root-ocsp-x1.der;
#ssl_trusted_certificate /etc/letsencrypt/live/dev.tecnicman.com/chain.pem;
resolver 1.1.1.1 1.0.0.1 valid=300s;
resolver_timeout 5s;
ssl_early_data on;
conf.d/dev.tecnicman.com.conf
server {
if ($host = dev.tecnicman.com) {
return 301 https://$host$request_uri;
} # managed by Certbot
listen 80;
listen [::]:80;
server_name dev.tecnicman.com;
}
server {
listen 443;
listen [::]:443;
listen 443 http3;
listen [::]:443 http3;
server_name dev.tecnicman.com;
add_header Alt-Svc 'h3=":443"; ma=3600';
include ssl-params.conf;
location / {
proxy_pass http://192.168.2.110;
include proxy_params.conf;
proxy_buffers 128 8k;
proxy_buffer_size 512k;
proxy_busy_buffers_size 512k;
add_header Alt-Svc 'h3=":443"; ma=3600';
}
# include snippets/self-signed.conf;
ssl_certificate /etc/letsencrypt/live/dev.tecnicman.com/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/dev.tecnicman.com/privkey.pem; # managed by Certbot
}
(that's definitely helped :D). However, I cannot still enable OCSP stapling as I usually do by putting: