![nginx OCSP 装订 centos let's encrypt](https://linux22.com/image/719272/nginx%20OCSP%20%E8%A3%85%E8%AE%A2%20centos%20let's%20encrypt.png)
在 centos 上,但我想对于每个操作系统,我都想让 ocsp 装订在 Nginx 中工作
ssl_stapling on;
ssl_trusted_certificate ??????;
ssl_stapling_verify on;
我应该定义什么ssl_trusted_certificate
?人们谈论“链+根文件”或 root.ca,但我不清楚这些文件是否已经在我的服务器上,或者在哪里可以找到/创建它们。
我拥有 Let's Encrypt 的有效证书,并且 SSL/TLS (https) 已运行正常。但我接下来该怎么做?
答案1
如果有人想知道...
ssl_stapling on;
ssl_trusted_certificate /etc/letsencrypt/live/DOMAIN/chain.pem;
#ssl_stapling_verify on;
注意哈希,由于没有验证,它实际上有效:
在命令行上:
openssl s_client -connect DOMAIN:443 -tls1 -tlsextdebug -status |grep OCSP -A 2 -B 1
OCSP response:
======================================
OCSP Response Data:
OCSP Response Status: successful (0x0)
Response Type: Basic OCSP Response
Version: 1 (0x0)
Responder Id: C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3