Resolved OCSP Stapling for the Plesk Panel

[Lloyd_mcse]

Hi guys,
I've been thinking about adding OCSP to the Plesk Panel, but I wasn't sure of the best way to do it.
I think I could just add the directives to...

/etc/sw-cp-server/conf.d/plesk.conf

Or I was thinking I could add these directives to a file called

/etc/sw-cp-server/conf.d/ocsp.inc

and add a link in the plesk.conf file, eg...

include conf.d/*ocsp.inc;

I have decided to go with the latter and it's all working.
So that's great, HSTS and OCSP enabled on my Plesk port, I use one domain for Plesk.

I'm using Ubuntu 12.04.4 LTS and Plesk 11.5.30 #37

I hope this helps someone else.
Regards

Lloyd

 

[Lloyd_mcse]

To add a bit more to this, the file /etc/sw-cp-server/conf.d/ocsp.inc contains...

    ssl_stapling on;
    ssl_stapling_verify on;
    ssl_trusted_certificate /etc/ssl/certs/Domain_CA.pem;
    resolver 8.8.4.4 8.8.8.8 valid=300s;
    resolver_timeout 10s;

And Domain_CA.pem contains...

the domains Intermediate certificate
the domains Root Certificate

In that order.
I hope it helps.
Regards

Lloyd

 

[Walter]

With the introduction of Let's Encrypt to Plesk and the fact that the cert changes every 60 days... How would you suggest implementing OCSP?

The latest version of the Let's Encrypt Extension 2.0.2 Release 29 adds their certificates to a directory...
/usr/local/psa/var/modules/letsencrypt/etc/live/yourdomainname.tld

The name remains the same throughout certificate renewals.

I have added the following into the nginx additional directives... however, it isn't working. I replaced domain.tld with my actual domain.tld. I also validated that these files exist at the specified locations.

ssl_certificate /usr/local/psa/var/modules/letsencrypt/etc/live/domain.tld/fullchain.pem;
ssl_certificate_key /usr/local/psa/var/modules/letsencrypt/etc/live/domain.tld/privkey.pem;
ssl_stapling on;
ssl_stapling_verify on;
resolver 8.8.4.4 8.8.8.8 valid=300s;
resolver_timeout 10s;

 

[UFHH01]

Hi Walter,

pls. be aware, that this thread is about "OCSP Stapling for the Plesk Panel" and in addition for "Plesk 11.x for Linux"

... and not for your domain - specific nginx configuration files.


Even with Let's Encrypt certificates, the mentioned suggestion still works as described by @Lloyd_mcse for the Plesk Control Panel and you would certainly use the domain - specific "chain.pem" for the definition at "ssl_trusted_certificate".