Will/does the letsencrypt client create a cert chain usable with OCSP stapling?

Server
2

https://certificate.revocationcheck.com/helloworld.letsencrypt.org shows helloworld.letsencrypt.org is correctly stapling.

That machine is running nginx >= 1.8, and has this configuration:

    # Site-Specific HTTPS configuration
    ssl_certificate      /etc/letsencrypt/live/helloworld.letsencrypt.org/fullchain.pem;
    ssl_certificate_key  /etc/letsencrypt/live/helloworld.letsencrypt.org/privkey.pem;
    ssl_trusted_certificate /etc/letsencrypt/live/helloworld.letsencrypt.org/fullchain.pem;
    ssl_stapling on;
    ssl_stapling_verify on;

Hope that helps!

5 Likes