{"id":241,"date":"2012-11-15T11:56:31","date_gmt":"2012-11-15T19:56:31","guid":{"rendered":"http:\/\/unmitigatedrisk.com\/?p=241"},"modified":"2015-12-15T20:20:43","modified_gmt":"2015-12-16T04:20:43","slug":"priming-the-ocsp-cache-in-nginx","status":"publish","type":"post","link":"https:\/\/unmitigatedrisk.com\/?p=241","title":{"rendered":"Priming the OCSP cache in Nginx"},"content":{"rendered":"

So recently GlobalSign, DigiCert, and Comodo worked together with Nginx to get OCSP stapling supoported<\/a>\u00a0in Nginx 1.3.7,\u00a0unfortunately\u00a0architectural\u00a0restrictions made it impractical to make it so that pre-fetching the OCSP response on server start-up so instead the first connection to the server primes the cache that is used for later connections.<\/p>\n

This is a fine compromise but what if you really want the first connection to have the benefit too? Well there are two approaches you can take:<\/p>\n

    \n
  1. Right after you start the server you do a SSL request to prime the cache.<\/li>\n
  2. You manually get the ocsp response and plumb it where Nginx is looking for it.<\/li>\n<\/ol>\n

    The first model is easy, right after you start your server use the OpenSSL s_client to connect to the server with OCSP stapling enabled \u00a0just like I documented in this post<\/a>, the first request will trigger the retrieval of the OCSP response by Nginx.<\/p>\n

    <\/div>\n
    The second model can be done before you start the server, you need to find the URI for the OCSP responder, do a OCSP request and populate the Nginx cache manually, this would look something like:<\/div>\n

    #!\/bin\/sh
    \nISSUER_CER=$1
    \nSERVER_CER=$2<\/p>\n

    URL=$(openssl x509 -in $SERVER_CER -text | grep “OCSP – URI:” | cut -d: -f2,3)<\/p>\n

    openssl ocsp -noverify -no_nonce -respout ocsp.resp -issuer \\
    \n$ISSUER_CER -cert $SERVER_CER -url $URL<\/p>\n

    Where “ocsp.resp” is whatever file you have configured in Nginx for the “ssl_stapling_file<\/a>“.<\/p>\n

    Each approach has its pros and cons, for example with the first approach your execution of the s_client call may not be the first request the server sees, with the second approach if you are using a certificate that\u00a0doesn’t\u00a0contain a OCSP pointer and have manually told Nginx where to fetch certificate status from then it won’t work.<\/p>\n

    It is worth noting you can run this same script in a cron script to ensure your server never needs to hit the wire (and potentially block when doing so) when it tries to keep its OCSP cache up to date.<\/p>\n

     <\/p>\n

     <\/p>\n","protected":false},"excerpt":{"rendered":"

    So recently GlobalSign, DigiCert, and Comodo worked together with Nginx to get OCSP stapling supoported\u00a0in Nginx 1.3.7,\u00a0unfortunately\u00a0architectural\u00a0restrictions made it impractical to make it so that pre-fetching the OCSP response on server start-up so instead the first connection to the server primes the cache that is used for later connections. This is a fine compromise but […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[35,3],"tags":[64,25,65],"class_list":["post-241","post","type-post","status-publish","format-standard","hentry","category-performance","category-security","tag-nginx","tag-ocsp","tag-ocsp-stapling"],"_links":{"self":[{"href":"https:\/\/unmitigatedrisk.com\/index.php?rest_route=\/wp\/v2\/posts\/241","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/unmitigatedrisk.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/unmitigatedrisk.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/unmitigatedrisk.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/unmitigatedrisk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=241"}],"version-history":[{"count":0,"href":"https:\/\/unmitigatedrisk.com\/index.php?rest_route=\/wp\/v2\/posts\/241\/revisions"}],"wp:attachment":[{"href":"https:\/\/unmitigatedrisk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=241"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/unmitigatedrisk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=241"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/unmitigatedrisk.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=241"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}