


How to set up OCSP Stapling in Apache for better SSL performance?
Jul 05, 2025 am 12:03 AMTo enable OCSP stapling in Apache, ensure you meet the prerequisites and configure the necessary directives. First, confirm you are using Apache 2.4.1 or newer with mod_ssl enabled, OpenSSL 0.9.8h or newer, and have a valid SSL certificate installed. Next, edit your Apache SSL virtual host config block by adding: SSLEngine on, SSLUseStapling on, and SSLStaplingCache "shmcb:/var/run/ocsp(128000)". Also, correctly set SSLCertificateFile, SSLCertificateKeyFile, and SSLCertificateChainFile to point to your certificate files. Optionally, adjust SSLStaplingResponderTimeout, SSLStaplingResponseTimeSkew, or SSLStaplingStandardCacheWhileMgmt for fine-tuning if needed. Finally, restart Apache and test your configuration using SSL Labs' SSL Test or the openssl s_client command to verify OCSP stapling is working.
OCSP stapling isn't just a fancy SSL feature—it's a practical way to speed up your HTTPS connections and reduce reliance on external OCSP servers. By enabling it in Apache, you offload the certificate status check from the client to your own server, making the handshake faster and more private.
Make Sure You Have the Right Setup
Before diving into configuration, double-check your environment:
- Apache version: At least 2.4.1 (preferably newer)
- mod_ssl must be enabled
- OpenSSL 0.9.8h or newer (for OCSP support)
- A valid SSL certificate and intermediate CA chain installed
You’ll also need access to your Apache config files—usually found in /etc/httpd/conf.d/ssl.conf
or /etc/apache2/sites-available/default-ssl.conf
, depending on your OS/distribution.
If you're using Let’s Encrypt, good news: their certificates work well with OCSP stapling out of the box.
Enable OCSP Stapling in Apache
To turn on OCSP stapling, edit your Apache SSL virtual host config block. Here’s what you need to add:
SSLEngine on SSLUseStapling on SSLStaplingCache "shmcb:/var/run/ocsp(128000)"
The SSLStaplingCache
line sets up a shared memory cache for OCSP responses. The number in parentheses is the size in bytes—128KB is usually enough for most sites. If you run a high-traffic site with many different certificates, you might want to increase this value.
Also, make sure your SSL certificate and chain are correctly configured with:
SSLCertificateFile "/path/to/cert.pem" SSLCertificateKeyFile "/path/to/privkey.pem" SSLCertificateChainFile "/path/to/chain.pem"
Without a complete chain, OCSP stapling may not work reliably.
Fine-Tune Optional Settings (If Needed)
By default, Apache handles OCSP fetching automatically. But if you want more control, here are some optional settings:
SSLStaplingResponderTimeout
: How long Apache waits for the OCSP responder (default 3 seconds)SSLStaplingResponseTimeSkew
: Skew tolerance for response timestamps (default 300 seconds)SSLStaplingStandardCacheWhileMgmt
: Whether to use standard caching rules (off by default)
For example, if your CA's OCSP server is slow, you might adjust the timeout:
SSLStaplingResponderTimeout 5
But unless you're troubleshooting issues or have specific needs, sticking with defaults is fine.
Test That It’s Working
After restarting Apache (sudo apachectl graceful
), test your setup:
- Use SSL Labs' SSL Test — look for “OCSP stapling: yes”
- Or run this OpenSSL command from another machine:
openssl s_client -connect yoursite.com:443 -servername yoursite.com -status
Look for an OCSP response
section in the output. If it's there, you're good.
Keep in mind that browsers and clients won’t show any visible change, but performance tools like Chrome DevTools might reflect a shorter TLS negotiation time.
That’s basically it. Not too hard once you know which directives to use—and definitely worth it for better SSL performance.
The above is the detailed content of How to set up OCSP Stapling in Apache for better SSL performance?. For more information, please follow other related articles on the PHP Chinese website!

Hot AI Tools

Undress AI Tool
Undress images for free

Undresser.AI Undress
AI-powered app for creating realistic nude photos

AI Clothes Remover
Online AI tool for removing clothes from photos.

Clothoff.io
AI clothes remover

Video Face Swap
Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Article

Hot Tools

Notepad++7.3.1
Easy-to-use and free code editor

SublimeText3 Chinese version
Chinese version, very easy to use

Zend Studio 13.0.1
Powerful PHP integrated development environment

Dreamweaver CS6
Visual web development tools

SublimeText3 Mac version
God-level code editing software (SublimeText3)

Hot Topics

Software preparation I am using a virtual machine with CentOS-6.6, with the host name repo. Refer to the steps to install a Linux virtual machine in Windows, I installed JDK in that virtual machine, refer to the guide to installing JDK in Linux. In addition, the virtual machine is configured with a key-free login itself, and the settings for configuring key-free login between each virtual machine are referenced. The download address of Hadoop installation package is: https://mirrors.aliyun.com/apache/hadoop/common/. I am using hadoop 2.6.5 version. Upload the Hadoop installation package to the server and unzip [root@repo~]#tarzxv

NGINX and Apache are both powerful web servers, each with unique advantages and disadvantages in terms of performance, scalability and efficiency. 1) NGINX performs well when handling static content and reverse proxying, suitable for high concurrency scenarios. 2) Apache performs better when processing dynamic content and is suitable for projects that require rich module support. The selection of a server should be decided based on project requirements and scenarios.

NGINX is more suitable for handling high concurrent connections, while Apache is more suitable for scenarios where complex configurations and module extensions are required. 1.NGINX is known for its high performance and low resource consumption, and is suitable for high concurrency. 2.Apache is known for its stability and rich module extensions, which are suitable for complex configuration needs.

NGINX and Apache each have their own advantages and disadvantages, and the choice should be based on specific needs. 1.NGINX is suitable for high concurrency scenarios because of its asynchronous non-blocking architecture. 2. Apache is suitable for low-concurrency scenarios that require complex configurations, because of its modular design.

PHP code can be executed in many ways: 1. Use the command line to directly enter the "php file name" to execute the script; 2. Put the file into the document root directory and access it through the browser through the web server; 3. Run it in the IDE and use the built-in debugging tool; 4. Use the online PHP sandbox or code execution platform for testing.

The steps to deploy a Joomla website on PhpStudy include: 1) Configure PhpStudy, ensure that Apache and MySQL services run and check PHP version compatibility; 2) Download and decompress PhpStudy's website from the official Joomla website, and then complete the installation through the browser according to the installation wizard; 3) Make basic configurations, such as setting the website name and adding content.

Updating the Tomcat version in the Debian system generally includes the following process: Before performing the update operation, be sure to do a complete backup of the existing Tomcat environment. This covers the /opt/tomcat folder and its related configuration documents, such as server.xml, context.xml, and web.xml. The backup task can be completed through the following command: sudocp-r/opt/tomcat/opt/tomcat_backup Get the new version Tomcat Go to ApacheTomcat's official website to download the latest version. According to your Debian system

Reasons for system performance not recovered after uninstalling the Apache service may include resource occupancy by other services, error messages in log files, resource consumption by abnormal processes, network connection problems, and file system residues. First, check whether there are other services or processes before uninstalling with Apache; second, pay attention to the operating system's log files and find error messages that may occur during the uninstallation process; second, check the system's memory usage and CPU load, and find out abnormal processes; then, use the netstat or ss command to view the network connection status to ensure that no ports are occupied by other services; finally, clean up the remaining configuration files and log files after uninstallation to avoid occupying disk space.
