What is OCSP Stapling? How to Enable It in Nginx & Apache to Boost HTTPS Speed

How OCSP Stapling Works

In standard OCSP verification, when a user visits your HTTPS website, their browser pauses and contacts the Certificate Authority's OCSP responder server to ask "Is this certificate still valid?". This adds 100–300ms of latency and leaks the visitor's browsing history to the CA.

With OCSP Stapling, your web server queries the CA periodically, caches the cryptographically signed validity timestamp, and "staples" it directly to the initial TLS handshake.

How to Enable OCSP Stapling in Nginx

# Enable OCSP Stapling
ssl_stapling on;
ssl_stapling_verify on;

# Point to fullchain and trusted DNS resolvers
ssl_trusted_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
resolver 1.1.1.1 8.8.8.8 valid=300s;
resolver_timeout 5s;