Apache's OCSP stapling configuration is set at the global server level (not inside individual VirtualHost blocks), typically in the main SSL module configuration file.
SSLUseStapling on
SSLStaplingCache "shmcb:/var/run/ocsp(128000)"SSLStaplingCache defines where Apache caches fetched OCSP responses between requests — a shared memory cache (as shown) is the common choice, avoiding a fresh OCSP fetch on every single connection.
Verifying it's working
The same OpenSSL command used to verify Nginx stapling works identically here: openssl s_client -connect yourdomain.com:443 -status, checking for a successful OCSP response status in the output.
What to do if stapling shows as configured but isn't actually working
Confirming with `openssl s_client -connect yourdomain.com:443 -status` that a stapled OCSP response is actually being returned, rather than assuming the configuration directive alone guarantees it's working, catches cases where a missing cache directive or firewall rule silently prevents stapling from functioning.
How Apache's SSLStaplingCache directive specifically enables OCSP stapling to function
Apache requires an explicitly configured SSLStaplingCache directive, typically pointing to a shared memory cache, to actually store and serve stapled OCSP responses — without it, enabling SSLUseStapling alone doesn't provide a place for Apache to cache the fetched OCSP response, and stapling won't function correctly.
What SSLStaplingReturnResponderErrors controls and why the default matters
This directive controls whether Apache forwards an OCSP responder's error response to clients or simply omits stapling entirely on error — the default, safer behavior generally omits stapling rather than forwarding a potentially confusing error, worth understanding if you're troubleshooting unexpected stapling behavior.
How to confirm stapling is providing a genuine performance benefit for your specific traffic pattern
Comparing handshake timing with stapling enabled versus disabled, using browser DevTools' detailed timing breakdown, shows the actual measured difference for your specific server and typical visitor latency — the benefit is generally more noticeable for visitors on higher-latency connections than for very fast, low-latency ones.
Why some Apache versions require additional configuration for stapling to function correctly
Older Apache versions had less complete or slightly different stapling implementation details than current versions — checking your specific Apache and mod_ssl version against current official documentation, particularly around the staple cache configuration, avoids following outdated guidance that may not match your installed version's exact requirements.
What to do if Apache logs show cache-related errors related to stapling
A cache-related error in Apache's logs specifically points to the SSLStaplingCache directive being missing or misconfigured — confirming a shared memory cache is correctly configured and that Apache has permission to create it resolves this specific class of stapling error.
How to test stapling is working using a method other than OpenSSL directly
Several online SSL scan tools explicitly report OCSP stapling status as part of their standard test, providing a visual, browser-based alternative to interpreting raw OpenSSL command output for anyone less comfortable with the command line.
A closing note on stapling as one piece of a broader TLS hardening checklist
OCSP stapling is best understood as one specific item within a broader TLS hardening checklist, alongside strong cipher suites, HSTS, and a complete certificate chain — individually modest, but part of what collectively distinguishes a genuinely well-configured server from a merely functional one.
A final practical tip for catching a future regression
Once stapling is confirmed working, periodically re-verifying it after any Apache upgrade or major configuration change catches a regression early, since a configuration change elsewhere can sometimes inadvertently affect stapling without an obvious, immediately visible symptom.