Apache's OCSP stapling configuration is set at the global server level (not inside individual VirtualHost blocks), typically in the main SSL module configuration file.
SSLUseStapling on
SSLStaplingCache "shmcb:/var/run/ocsp(128000)"SSLStaplingCache defines where Apache caches fetched OCSP responses between requests — a shared memory cache (as shown) is the common choice, avoiding a fresh OCSP fetch on every single connection.
Verifying it's working
The same OpenSSL command used to verify Nginx stapling works identically here: openssl s_client -connect yourdomain.com:443 -status, checking for a successful OCSP response status in the output.
What to do if stapling shows as configured but isn't actually working
Confirming with `openssl s_client -connect yourdomain.com:443 -status` that a stapled OCSP response is in fact being returned, rather than assuming the configuration directive alone guarantees it's working, catches cases where a missing cache directive or firewall rule silently prevents stapling from functioning.
How Apache's SSLStaplingCache directive exactly enables OCSP stapling to function
Apache requires an explicitly configured SSLStaplingCache directive, typically pointing to a shared memory cache, to store and serve stapled OCSP responses — without it, enabling SSLUseStapling alone doesn't provide a place for Apache to cache the fetched OCSP response, and stapling won't function correctly.
What SSLStaplingReturnResponderErrors controls and why the default matters
This directive controls whether Apache forwards an OCSP responder's error response to clients or simply omits stapling entirely on error — the default, safer behavior generally omits stapling rather than forwarding a potentially confusing error, worth understanding if you're troubleshooting unexpected stapling behavior.
How to confirm stapling is providing a genuine performance benefit for your specific traffic pattern
Comparing handshake timing with stapling enabled versus disabled, using browser DevTools' detailed timing breakdown, shows the actual measured difference for your specific server and typical visitor latency — the benefit is generally more noticeable for visitors on higher-latency connections than for very fast, low-latency ones.
Why some Apache versions require additional configuration for stapling to function correctly
Older Apache versions had less complete or slightly different stapling implementation details than current versions — checking your specific Apache and mod_ssl version against current official documentation, particularly around the staple cache configuration, avoids following outdated guidance that may not match your installed version's exact requirements.
What to do if Apache logs show cache-related errors related to stapling
A cache-related error in Apache's logs in particular points to the SSLStaplingCache directive being missing or misconfigured — confirming a shared memory cache is correctly configured and that Apache has permission to create it resolves this specific class of stapling error.
How to test stapling is working using a method other than OpenSSL
Several online SSL scan tools explicitly report OCSP stapling status as part of their standard test, providing a visual, browser-based alternative to interpreting raw OpenSSL command output for anyone less comfortable with the command line.
A closing note on stapling as one piece of a broader TLS hardening checklist
OCSP stapling is best understood as one specific item within a broader TLS hardening checklist, alongside strong cipher suites, HSTS, and a complete certificate chain — individually modest, but part of what collectively distinguishes a in practice well-configured server from a merely functional one.
See RFC 6960, the OCSP specification.
Loading comments…