| 验证命令 | s_client -status 查看 OCSP Response 区段 |
|---|---|
| 必要配置 | ssl_stapling on + ssl_stapling_verify on + ssl_trusted_certificate |
| 网络前提 | resolver 可达且能解析 OCSP 域名 |
验证与服务端配置
验证与服务端配置
echo | openssl s_client -connect example.com:443 -servername example.com -status 2>/dev/null | grep -A3 -i 'OCSP response'
nginx -T | grep -n 'ssl_stapling\|ssl_trusted_certificate\|resolver'nginx 参考配置
nginx 参考配置
ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /etc/nginx/ssl/chain.pem;
resolver 223.5.5.5 1.1.1.1 valid=300s;
resolver_timeout 5s;resolver 需选择本机实际可达的解析服务；若证书的 CA 没有 OCSP 端点，装订不会生效。