Nginx OCSP Stapling Trusted Cert Validator

Threat/Impact Level: HIGH | Exploitability/Downtime Risk: HIGH | Time to Fix: 10 mins

TL;DR

• What broke: ssl_stapling_verify on is set in your Nginx config, but no ssl_trusted_certificate directive exists — Nginx cannot verify the OCSP responder's signature, so stapling silently fails or errors out at startup.
• How to fix it: Add ssl_trusted_certificate /path/to/ca-chain.pem; pointing to your issuing CA's full chain (root + intermediates), and add a resolver directive so Nginx can reach the OCSP endpoint.
• Fast path: Use our Client-Side Sandbox above to auto-refactor this — paste your server block and get a corrected config with the missing directives injected.

nginx: [warn] ssl_stapling_verify: no trusted certificate provided
OCSP stapling failed: ssl_stapling_verify is on but no trusted certificate provided

2024/01/15 03:42:11 [error] 1234#0: OCSP_basic_verify() failed
    (SSL: error:27069076:OCSP routines:OCSP_basic_verify:signer certificate not found)
    while requesting certificate status, responder: ocsp.sectigo.com

How to Fix It (The Solution)

Root Cause

ssl_stapling_verify on instructs Nginx to verify the OCSP response signature using a trusted CA certificate. Nginx uses ssl_trusted_certificate for this — it is separate from ssl_certificate (your leaf cert + chain). If ssl_trusted_certificate is absent, Nginx has no anchor to verify the OCSP responder's signature against.

Step 1 — Build the CA chain PEM

You need a PEM file containing intermediate CA(s) + root CA (not your leaf cert).

# For Let's Encrypt (chain.pem already contains intermediates)
cp /etc/letsencrypt/live/yourdomain.com/chain.pem /etc/nginx/ssl/ocsp-chain.pem

# For commercial CAs (Sectigo, DigiCert, etc.) — concatenate manually:
cat intermediate.crt root.crt > /etc/nginx/ssl/ocsp-chain.pem

# Verify the chain is correct:
openssl verify -CAfile /etc/nginx/ssl/ocsp-chain.pem /etc/nginx/ssl/yourdomain.crt
# Expected: yourdomain.crt: OK

Basic Fix

 server {
     listen 443 ssl;
     server_name yourdomain.com;
 
     ssl_certificate     /etc/nginx/ssl/yourdomain.crt;
     ssl_certificate_key /etc/nginx/ssl/yourdomain.key;
 
     ssl_stapling on;
     ssl_stapling_verify on;
+    ssl_trusted_certificate /etc/nginx/ssl/ocsp-chain.pem;
+    resolver 8.8.8.8 8.8.4.4 valid=300s;
+    resolver_timeout 5s;
 }

Enterprise Best Practice

In production, do not use public resolvers (8.8.8.8). Use your internal DNS resolvers or a dedicated resolver with DNSSEC validation. Also pin the OCSP chain to a file managed by your secrets/cert pipeline, not manually placed.

 server {
     listen 443 ssl;
     server_name yourdomain.com;
 
     ssl_certificate     /etc/nginx/ssl/yourdomain_fullchain.pem;
     ssl_certificate_key /etc/nginx/ssl/yourdomain.key;
 
     ssl_stapling on;
     ssl_stapling_verify on;
-    # ssl_trusted_certificate missing — OCSP verify broken
+    ssl_trusted_certificate /etc/nginx/ssl/ocsp-chain.pem;
 
-    # No resolver — Nginx cannot reach OCSP endpoint
+    resolver 10.0.0.2 10.0.0.3 valid=300s ipv6=off;
+    resolver_timeout 10s;
 
     # Harden further: cache stapled responses
+    ssl_session_cache    shared:SSL:10m;
+    ssl_session_timeout  1d;
+    ssl_session_tickets  off;
 }

After applying:

nginx -t && nginx -s reload

# Verify stapling is working:
openssl s_client -connect yourdomain.com:443 -status -tlsextdebug 2>&1 \
  | grep -A 10 'OCSP response'
# Look for: OCSP Response Status: successful (0x0)

💡 Tired of pasting proprietary infrastructure configs into public LLMs? Generic AI interfaces log your company's ARNs, connection strings, and private keys. StackEngine enforces client-side zero-trust boundaries—the sandbox above executes 100% locally in your browser. Drop your broken manifest above to redact secrets locally and synthesize deterministic patch drafts with your own API key.

(For CI/CD pipeline automation, install via npm i -g stackengine).

# Use gixy — Nginx static security analyzer
pip install gixy
gixy /etc/nginx/nginx.conf
# Flags missing ssl_trusted_certificate when ssl_stapling_verify is on

# .checkov.yml
checks:
  - CKV_NGINX_5  # Ensure ssl_stapling is enabled
  - CKV_NGINX_6  # Ensure ssl_trusted_certificate is present with stapling_verify

- name: Verify OCSP Stapling
  run: |
    RESPONSE=$(echo | openssl s_client \
      -connect ${{ secrets.DOMAIN }}:443 \
      -status 2>&1 | grep 'OCSP Response Status')
    echo "$RESPONSE"
    echo "$RESPONSE" | grep -q 'successful' || \
      (echo '❌ OCSP stapling not working' && exit 1)

# /etc/letsencrypt/renewal-hooks/deploy/rebuild-ocsp-chain.sh
#!/bin/bash
cp /etc/letsencrypt/live/${RENEWED_DOMAINS}/chain.pem \
   /etc/nginx/ssl/ocsp-chain.pem
nginx -s reload