SSL - OCSP stapling and nginx, rapidssl

[Mouth]

Does anyone have OCSP stapling active/working on their nginx with rapidssl certificate?

My nginx conf is ...

        ssl_certificate netrider.net.au.crt;
        ssl_certificate_key netrider.net.au.key;
        add_header Strict-Transport-Security $hsts_header;
        ssl_stapling            on;
        ssl_stapling_verify     on;
        ssl_trusted_certificate rapidssl.pem;

netrider.net.au.crt contains my server certificate
rapidssl.pem contains the intermediary certificate from https://ssl-tools.net/certificates/nakw2x-rapidssl-sha256-ca-g3

My SSLLabs test at https://www.ssllabs.com/ssltest/analyze.html?d=netrider.net.au is still showing OCSP stapling as no.

 

[MattW]

You need to have a resolver configured in there as well

  resolver 8.8.4.4 8.8.8.8 valid=300s;
  resolver_timeout 10s;

 

[Mouth]

You need to have a resolver configured in there as well

Yes, thanks. Got that already. Forgot to include it in OP

 

[Andy.N]

I too use RapidSSL and got into this issue. You need to replace your rapidssl.pem by
cat Intermediate.crt GeoTrust_Global_CA.crt > ssl-trusted.crt
https://community.centminmod.com/threads/nginx-ssl-cipher-suite.714/page-3#post-9444

 

[rainmotorsports]

I too use RapidSSL and got into this issue. You need to replace your rapidssl.pem by
cat Intermediate.crt GeoTrust_Global_CA.crt > ssl-trusted.crt
https://community.centminmod.com/threads/nginx-ssl-cipher-suite.714/page-3#post-9444

Thats probably it. Pretty sure I followed the same type of instructions for a cert from some other company and my OCSP stapling is showing as yes - https://www.ssllabs.com/ssltest/analyze.html?d=raindd.com

 

[Mouth]

I too use RapidSSL and got into this issue. You need to replace your rapidssl.pem by
cat Intermediate.crt GeoTrust_Global_CA.crt > ssl-trusted.crt
https://community.centminmod.com/threads/nginx-ssl-cipher-suite.714/page-3#post-9444

That was it - thanks!
Got Intermediate.crt from the email with my server cert, and GeoTrust_Global_CA.crt from https://www.geotrust.com/resources/root_certificates/certificates/GeoTrust_Global_CA.cer