# NGINX OCSP not responding

**URL:** <https://community.letsencrypt.org/t/nginx-ocsp-not-responding/8502>\
**Category:** Server\
**Created:** [January 8, 2016, 3:50am UTC](https://community.letsencrypt.org/t/nginx-ocsp-not-responding/8502 "2016-01-08T03:50:27Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Saturn2888](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/saturn2888/32/4099_2.png) [@Saturn2888](https://community.letsencrypt.org/u/Saturn2888)\
**Post date:** [January 8, 2016, 3:50am UTC](https://community.letsencrypt.org/t/nginx-ocsp-not-responding/8502/1 "2016-01-08T03:50:27Z")

</div>

Ubuntu 14.04 (3.13.0-24-generic)  
NOTE: When using NGINX 1.4.6 or 1.8.0 with this config, I am able to get an A+ on SSL Labs, but **OCSP is not responding.**

Is this a Let’s Encrypt problem or something else entirely?

```nginx
server {
    listen 80;
    listen 443 ssl http2;

    server_name dev.mysite.com;

    keepalive_timeout 70;

    ssl on;

    ssl_certificate /etc/letsencrypt/live/dev.mysite.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/dev.mysite.com/privkey.pem;

    ssl_dhparam /etc/ssl/certs/dhparam.pem;

    ssl_stapling on;
    ssl_stapling_verify on;

    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 5m;
    ssl_session_tickets off;

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers 'AESGCM:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES128-SHA256:AES256-SHA256:AES256-SHA:AES128-SHA256:AES128-SHA:!aNULL:!MD5';
    ssl_prefer_server_ciphers on;

    # resolver 127.0.0.1 valid=300s;
    # resolver 8.8.8.8 8.8.4.4 valid=1s;
    # resolver_timeout 5s;

    add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";
    add_header X-Frame-Options DENY;
    add_header X-Content-Type-Options nosniff;

    access_log /var/log/nginx/dev.mysite.com.access.log;
    error_log /var/log/nginx/dev.mysite.com.error.log;

    location / {
        proxy_pass http://127.0.0.1:37453/;
    }
}

```

---

<div class="post-metadata">

**Author:** ![prusswan](https://avatars.discourse-cdn.com/v4/letter/p/b5e925/32.png) [@prusswan](https://community.letsencrypt.org/u/prusswan)\
**Post date:** [January 8, 2016, 5:45am UTC](https://community.letsencrypt.org/t/nginx-ocsp-not-responding/8502/2 "2016-01-08T05:45:29Z")

</div>

Not a LE issue, but nginx behavior. You may need to manually verify that oscp stapling is working as intended. For automation purposes, this was raised as an issue (more like enhancement) in LE

More info:

> **[How to make OCSP stapling on nginx work](https://matthiasadler.info/blog/ocsp-stapling-on-nginx-with-comodo-ssl/)**
>
> Its a bit tricky to get OCSP stapling on nginx right. But with a little effort it is possible to reap the privacy, security and performance benefits.

  

> <https://github.com/certbot/certbot/issues/956>

  
[https://trac.nginx.org/nginx/ticket/812](https://trac.nginx.org/nginx/ticket/812)

---

<div class="post-metadata">

**Author:** ![Saturn2888](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/saturn2888/32/4099_2.png) [@Saturn2888](https://community.letsencrypt.org/u/Saturn2888)\
**Post date:** [January 9, 2016, 3:24am UTC](https://community.letsencrypt.org/t/nginx-ocsp-not-responding/8502/5 "2016-01-09T03:24:38Z")

</div>

Huh, so it looks like I have to prefetch the OCSP responses so when a client asks NGINX, it’s there and ready to go? Sounds like a great thing to implement in LE natively 🙂.

I’ll spend some time on it. Thanks for the article! It never came up in my searches.

---

<div class="post-metadata">

**Author:** ![Fsantiago1979](https://avatars.discourse-cdn.com/v4/letter/f/c0e974/32.png) [@Fsantiago1979](https://community.letsencrypt.org/u/Fsantiago1979)\
**Post date:** [January 9, 2016, 4:47am UTC](https://community.letsencrypt.org/t/nginx-ocsp-not-responding/8502/6 "2016-01-09T04:47:31Z")

</div>

I use nginx and ocsp works fine. The one difference I see in our configs is I include:

ssl\_trusted\_certificate /etc/letsencrypt/live/Example.com/chain.pem;

---

<div class="post-metadata">

**Author:** ![Fsantiago1979](https://avatars.discourse-cdn.com/v4/letter/f/c0e974/32.png) [@Fsantiago1979](https://community.letsencrypt.org/u/Fsantiago1979)\
**Post date:** [January 9, 2016, 4:53am UTC](https://community.letsencrypt.org/t/nginx-ocsp-not-responding/8502/7 "2016-01-09T04:53:59Z")

</div>

important thing here is the usage of ssl\_trusted\_certificate. The nginx documentation states that:

For verification to work, the certificate of the server certificate issuer, the root certificate, and all intermediate certificates should be configured as trusted using the ssl\_trusted\_certificate directive.  
You have to include the root certificate (and intermediate certificates) for OCSP stapling to work, which is why ssl\_trusted\_certificate will be set to a special certificate file that includes those. If your ssl\_certificate already does, you might be able to skip using ssl\_trusted\_certificate.