Shammer's Philosophy

My private adversaria

First try OCSP Stapling on Debian Jessie but failed

This is a subsequent article of Apache 2.4 bundled as default on Debian Jessie - Shammerism. I tested enabling OCSP Stapling on Apache. A lot of sites tell the way how to configure apache to enable OSCP Stapling, for example How To Configure OCSP Stapling on Apache and Nginx | DigitalOcean, but only following configurations are not sufficient.

# OCSP Stapling
SSLStaplingCache shmcb:/tmp/stapling_cache(128000)
SSLCACertificateFile /etc/apache2/intermediate-ca-cert.pem
SSLUseStapling on

According to above site, SSLStaplingCache should be defined the outside of VirtualHost element. But, openssl s_client test result indicates OCSP Stapling doesn't work on this apache.

# openssl s_client -CAfile TrustCA.pem -connect mywebserver:443 -status
CONNECTED(00000003)
OCSP response: no response sent
...

Apache log is below.

ssl_stapling_init_cert: no OCSP URI in certificate and no SSLStaplingForceURL

I use the sever certificate generated by myself with openssl. I have to check my certificate options again.