# Will/does the letsencrypt client create a cert chain usable with OCSP stapling?

**URL:** <https://community.letsencrypt.org/t/will-does-the-letsencrypt-client-create-a-cert-chain-usable-with-ocsp-stapling/2072>\
**Category:** Server\
**Created:** [October 24, 2015, 2:32am UTC](https://community.letsencrypt.org/t/will-does-the-letsencrypt-client-create-a-cert-chain-usable-with-ocsp-stapling/2072 "2015-10-24T02:32:15Z")\
**Posts on this page:** 19\
**Page:** 1

<div class="post-metadata">

**Author:** ![Leliana](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/leliana/32/1034_2.png) [@Leliana](https://community.letsencrypt.org/u/Leliana)\
**Post date:** [October 24, 2015, 2:32am UTC](https://community.letsencrypt.org/t/will-does-the-letsencrypt-client-create-a-cert-chain-usable-with-ocsp-stapling/2072/1 "2015-10-24T02:32:15Z")

</div>

Title says it all, I’m testing with

```
ssl_certificate /etc/letsencrypt/live/le.revthefox.co.uk/cert.pem;
ssl_certificate_key /etc/letsencrypt/live/le.revthefox.co.uk/privkey.pem;
ssl_trusted_certificate /etc/letsencrypt/live/le.revthefox.co.uk/fullchain.pem;

```

But I’m not sure if the cert paths are right, specifically the one for OCSP stapling (ssl\_trusted\_certificate).

---

<div class="post-metadata">

**Author:** ![jcjones](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jcjones/32/78_2.png) [@jcjones](https://community.letsencrypt.org/u/jcjones)\
**Post date:** [October 24, 2015, 5:20am UTC](https://community.letsencrypt.org/t/will-does-the-letsencrypt-client-create-a-cert-chain-usable-with-ocsp-stapling/2072/2 "2015-10-24T05:20:19Z")

</div>

[https://certificate.revocationcheck.com/helloworld.letsencrypt.org](https://certificate.revocationcheck.com/helloworld.letsencrypt.org) shows [helloworld.letsencrypt.org](http://helloworld.letsencrypt.org) is correctly stapling.

That machine is running nginx \>= 1.8, and has this configuration:

```
    # Site-Specific HTTPS configuration
    ssl_certificate /etc/letsencrypt/live/helloworld.letsencrypt.org/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/helloworld.letsencrypt.org/privkey.pem;
    ssl_trusted_certificate /etc/letsencrypt/live/helloworld.letsencrypt.org/fullchain.pem;
    ssl_stapling on;
    ssl_stapling_verify on;

```

Hope that helps!

---

<div class="post-metadata">

**Author:** ![Leliana](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/leliana/32/1034_2.png) [@Leliana](https://community.letsencrypt.org/u/Leliana)\
**Post date:** [October 25, 2015, 5:04pm UTC](https://community.letsencrypt.org/t/will-does-the-letsencrypt-client-create-a-cert-chain-usable-with-ocsp-stapling/2072/3 "2015-10-25T17:04:54Z")

</div>

That clears it up, thanks.

---

<div class="post-metadata">

**Author:** ![upsuper](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/upsuper/32/1310_2.png) [@upsuper](https://community.letsencrypt.org/u/upsuper)\
**Post date:** [October 28, 2015, 2:31pm UTC](https://community.letsencrypt.org/t/will-does-the-letsencrypt-client-create-a-cert-chain-usable-with-ocsp-stapling/2072/4 "2015-10-28T14:31:16Z")

</div>

It seems using fullchain for "ssl\_trusted\_certificate" doesn't work. That field should be the "Root CA and Intermediate certs", and should not include the site certificate.

Nginx continues complaining the following message when I use the fullchain there:

> "ssl\_stapling" ignored, issuer certificate not found

---

<div class="post-metadata">

**Author:** ![eva2000](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/eva2000/32/289_2.png) [@eva2000](https://community.letsencrypt.org/u/eva2000)\
**Post date:** [October 28, 2015, 2:33pm UTC](https://community.letsencrypt.org/t/will-does-the-letsencrypt-client-create-a-cert-chain-usable-with-ocsp-stapling/2072/5 "2015-10-28T14:33:03Z")

</div>

[quote=“upsuper, post:4, topic:2072”]  
Nginx continues complaining the following message when I use the fullchain there:  
[/quote]where you seeing that error ?

---

<div class="post-metadata">

**Author:** ![upsuper](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/upsuper/32/1310_2.png) [@upsuper](https://community.letsencrypt.org/u/upsuper)\
**Post date:** [October 28, 2015, 2:35pm UTC](https://community.letsencrypt.org/t/will-does-the-letsencrypt-client-create-a-cert-chain-usable-with-ocsp-stapling/2072/6 "2015-10-28T14:35:26Z")

</div>

In /var/log/nginx/error.log

---

<div class="post-metadata">

**Author:** ![upsuper](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/upsuper/32/1310_2.png) [@upsuper](https://community.letsencrypt.org/u/upsuper)\
**Post date:** [October 28, 2015, 2:36pm UTC](https://community.letsencrypt.org/t/will-does-the-letsencrypt-client-create-a-cert-chain-usable-with-ocsp-stapling/2072/7 "2015-10-28T14:36:30Z")

</div>

Actually, probably the issue is not that it includes the site certificate, but because of the lack of root CA certificate.

---

<div class="post-metadata">

**Author:** ![eva2000](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/eva2000/32/289_2.png) [@eva2000](https://community.letsencrypt.org/u/eva2000)\
**Post date:** [October 28, 2015, 2:51pm UTC](https://community.letsencrypt.org/t/will-does-the-letsencrypt-client-create-a-cert-chain-usable-with-ocsp-stapling/2072/8 "2015-10-28T14:51:13Z")

</div>

yeah i was worried the fullchain.pem wasn’t ideal for ssl\_trusted\_certificate as usually i have intermediates in there and root is optional

but i also used fullchain.pem for ssl\_trusted\_certificate with letsencrypt at [Letsencrypt Webroot Authentication Tested on Beta invited/whitelisted domain](https://community.letsencrypt.org/t/letsencrypt-webroot-authentication-tested-on-beta-invited-whitelisted-domain/2276) and have no such errors in my logs

using Nginx 1.9.6

---

<div class="post-metadata">

**Author:** ![upsuper](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/upsuper/32/1310_2.png) [@upsuper](https://community.letsencrypt.org/u/upsuper)\
**Post date:** [October 28, 2015, 3:03pm UTC](https://community.letsencrypt.org/t/will-does-the-letsencrypt-client-create-a-cert-chain-usable-with-ocsp-stapling/2072/9 "2015-10-28T15:03:31Z")

</div>

Hmm, well, it seems my nginx is quite old. I’m using Ubuntu 14.04LTS, and the nginx is 1.4.6. I guess that probably explains why it doesn’t work. I probably should try to upgrade my server…

---

<div class="post-metadata">

**Author:** ![eva2000](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/eva2000/32/289_2.png) [@eva2000](https://community.letsencrypt.org/u/eva2000)\
**Post date:** [October 28, 2015, 3:07pm UTC](https://community.letsencrypt.org/t/will-does-the-letsencrypt-client-create-a-cert-chain-usable-with-ocsp-stapling/2072/10 "2015-10-28T15:07:18Z")

</div>

if you have other nginx ssl vhost sites on server, check their ssl configs i.e. you may have enabled ssl stapling on a self signed ssl vhost other than letsencrypt vhost

check all your nginx vhost files to make sure

```
grep -Ro ssl_stapling /path/to/nginx/conf/* | uniq

```

i.e. for me on [centminmod.com](http://centminmod.com) LEMP nginx

```
grep -Ro ssl_stapling /usr/local/nginx/conf/* | uniq
/usr/local/nginx/conf/conf.d/http2ssl.xyz.ssl.conf:ssl_stapling
/usr/local/nginx/conf/conf.d/le1.http2ssl.xyz.ssl.conf:ssl_stapling
```

---

<div class="post-metadata">

**Author:** ![eva2000](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/eva2000/32/289_2.png) [@eva2000](https://community.letsencrypt.org/u/eva2000)\
**Post date:** [October 28, 2015, 3:10pm UTC](https://community.letsencrypt.org/t/will-does-the-letsencrypt-client-create-a-cert-chain-usable-with-ocsp-stapling/2072/11 "2015-10-28T15:10:31Z")

</div>

oh forgot to ask you are using beta invite whitelisted domain [https://community.letsencrypt.org/t/beta-program-announcements/1631/6](https://community.letsencrypt.org/t/beta-program-announcements/1631/6) ?

if not in beta invite, then the letsencrypt ssl certificate is untrusted like self-signed so ssl stapling options should be disabled as such and only enabled if you have trusted ssl certificate obtained via beta invite whitelisted domains

---

<div class="post-metadata">

**Author:** ![kelunik](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/kelunik/32/359_2.png) [@kelunik](https://community.letsencrypt.org/u/kelunik)\
**Post date:** [October 31, 2015, 7:18pm UTC](https://community.letsencrypt.org/t/will-does-the-letsencrypt-client-create-a-cert-chain-usable-with-ocsp-stapling/2072/12 "2015-10-31T19:18:31Z")

</div>

Same issue here, but without any errors in the log. Also Nginx 1.4.6 on Ubuntu 14.04 LTS. I think it should work on Nginx \>= 1.3.7.

---

<div class="post-metadata">

**Author:** ![tlussnig](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/tlussnig/32/2053_2.png) [@tlussnig](https://community.letsencrypt.org/u/tlussnig)\
**Post date:** [November 17, 2015, 10:52pm UTC](https://community.letsencrypt.org/t/will-does-the-letsencrypt-client-create-a-cert-chain-usable-with-ocsp-stapling/2072/13 "2015-11-17T22:52:15Z")

</div>

Hi this ( [https://www.ssllabs.com/ssltest/analyze.html?d=suche.org](https://www.ssllabs.com/ssltest/analyze.html?d=suche.org) ) is the prove that LE works with OCSP-Stapling  
So maybe the Topic should be change to OCSP-Stpling + NGINX ?

---

<div class="post-metadata">

**Author:** ![eva2000](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/eva2000/32/289_2.png) [@eva2000](https://community.letsencrypt.org/u/eva2000)\
**Post date:** [November 17, 2015, 11:44pm UTC](https://community.letsencrypt.org/t/will-does-the-letsencrypt-client-create-a-cert-chain-usable-with-ocsp-stapling/2072/14 "2015-11-17T23:44:22Z")

</div>

best way to check is via command line

```
 openssl s_client -connect domain.com:443 -tls1 -tlsextdebug -status

```

look for

```
OCSP response: 
======================================
OCSP Response Data:
OCSP Response Status: successful (0x0)?
```

---

<div class="post-metadata">

**Author:** ![jsha](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jsha/32/12_2.png) [@jsha](https://community.letsencrypt.org/u/jsha)\
**Post date:** [November 18, 2015, 6:49am UTC](https://community.letsencrypt.org/t/will-does-the-letsencrypt-client-create-a-cert-chain-usable-with-ocsp-stapling/2072/15 "2015-11-18T06:49:16Z")

</div>

> It seems using fullchain for "ssl\_trusted\_certificate" doesn't work.

Yes, `ssl_trusted_certificate` should point at `chain.pem`, i.e. just the intermediate. I'm fairly confident the file it points to does _not_ need to include the root. I used OCSP stapling in this configuration on my own server.

---

<div class="post-metadata">

**Author:** ![eva2000](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/eva2000/32/289_2.png) [@eva2000](https://community.letsencrypt.org/u/eva2000)\
**Post date:** [November 18, 2015, 7:13am UTC](https://community.letsencrypt.org/t/will-does-the-letsencrypt-client-create-a-cert-chain-usable-with-ocsp-stapling/2072/16 "2015-11-18T07:13:54Z")

</div>

i use fullchain.pem for nginx and ocsp works - sometimes ssllab doesn’t report it but openssl cli command, testssl and cipherscan all report OCSP working

examples

- testssl [http://centminmod.com/letsencrypt-freessl.html#testssl](http://centminmod.com/letsencrypt-freessl.html#testssl)
- cipherscan [http://centminmod.com/letsencrypt-freessl.html#cipherscan](http://centminmod.com/letsencrypt-freessl.html#cipherscan)
- [https://certificate.revocationcheck.com/le10.http2ssl.xyz](https://certificate.revocationcheck.com/le10.http2ssl.xyz)

but yes root in fullchain.pem is generally not needed for ssl\_trusted\_certificate

---

<div class="post-metadata">

**Author:** ![kerio](https://avatars.discourse-cdn.com/v4/letter/k/f1d935/32.png) [@kerio](https://community.letsencrypt.org/u/kerio)\
**Post date:** [November 18, 2015, 9:23am UTC](https://community.letsencrypt.org/t/will-does-the-letsencrypt-client-create-a-cert-chain-usable-with-ocsp-stapling/2072/17 "2015-11-18T09:23:30Z")

</div>

Both `chain.pem` and `fullchain.pem` will work as the `ssl_trusted_certificate` for the purpose of OCSP verification, but `chain.pem` (aka one of the “Let’s Encrypt Authority X1” certificates) is more specific and, thus, better. The root is not needed in the case of Let’s Encrypt because the OCSP response is signed by the intermediate certificate itself.

---

<div class="post-metadata">

**Author:** ![sicco](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/sicco/32/4279_2.png) [@sicco](https://community.letsencrypt.org/u/sicco)\
**Post date:** [January 14, 2016, 1:16pm UTC](https://community.letsencrypt.org/t/will-does-the-letsencrypt-client-create-a-cert-chain-usable-with-ocsp-stapling/2072/18 "2016-01-14T13:16:08Z")

</div>

**Update**

The [Nginx documentation](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_stapling) says the following:

> For the OCSP stapling to work, the certificate of the server certificate issuer should be known. If the ssl\_certificate file does not contain intermediate certificates, the certificate of the server certificate issuer should be present in the ssl\_trusted\_certificate file.

So we don't need to specify `ssl_trusted_certificate`, because Let's Encrypt creates `fullchain.pem` containing all certificates and we use that for `ssl_certificate` already.

================================

I'm wondering specifying `ssl_trusted_certificate` actually makes a difference. I only specified the following using Nginx 1.9.9:

- `ssl_certificate` with `fullchain.pem`
- `ssl_certificate_key` with `privkey.pem`
- `ssl_stapling on`
- `ssl_stapling_verify on`

Still, the command `openssl s_client -connect <domain.com>:443 -tls1 -tlsextdebug -status` gives me a successful OCSP response for my domain. Adding `ssl_trusted_certificate` does not seem to change the output of openssl. Is it somehow more efficient to specify `ssl_trusted_certificate` or is it unnecessary?

---

<div class="post-metadata">

**Author:** ![Troon](https://avatars.discourse-cdn.com/v4/letter/t/839c29/32.png) [@Troon](https://community.letsencrypt.org/u/Troon)\
**Post date:** [January 14, 2016, 3:07pm UTC](https://community.letsencrypt.org/t/will-does-the-letsencrypt-client-create-a-cert-chain-usable-with-ocsp-stapling/2072/19 "2016-01-14T15:07:07Z")

</div>

I use nginx 1.4.6 as it’s the Ubuntu 14.04LTS version. I’ve found errors in the logs due to inability to get the OCSP response quickly enough. Errors looked like this:

`OCSP_basic_verify() failed (SSL: error:27069076:OCSP routines:OCSP_basic_verify:signer certificate not found) while requesting certificate status, responder: ocsp.int-x1.letsencrypt.org`

My solution is to get the stapled file “offline” via a shell script cron job.

[get-ocsp.sh](http://get-ocsp.sh):

```
#!/bin/sh
SITE=$1
LEDIR=/etc/letsencrypt/live
DIR=$LEDIR/$SITE
HOST=ocsp.int-x1.letsencrypt.org
MTO=my-email@example.com

openssl ocsp -no_nonce \
             -respout $DIR/ocsp.resp.new \
             -issuer $DIR/chain.pem \
             -verify_other $DIR/chain.pem \
             -cert $DIR/cert.pem \
             -url http://$HOST/ \
             -header "HOST" "$HOST" > $DIR/ocsp-reply.txt 2>&1

if grep -q ": good" $DIR/ocsp-reply.txt; then
    if cmp -s $DIR/ocsp.resp.new $DIR/ocsp.resp; then
        rm $DIR/ocsp.resp.new
    else
        mv $DIR/ocsp.resp.new $DIR/ocsp.resp
        service nginx reload > /dev/null
    fi
else
    cat $DIR/ocsp-reply.txt | mailx -s "OCSP error for $SITE" $MTO
fi

mv $DIR/ocsp-reply.txt $DIR/ocsp-reply-old.txt

```

Then, in the appropriate nginx site configuration file:

```
    ssl_stapling on;
    ssl_stapling_file /etc/letsencrypt/live/example.com/ocsp.resp;

```

and in the root crontab:

`6 * * * * /etc/letsencrypt/get-ocsp.sh example.com`

which refreshes it at 6 minutes past each hour.