Configuring OCSP Stapling

Working Principles

Certificate authorities (CAs) provide the OCSP for clients to verify certificate validity in real time. With OCSP stapling, CDN obtains and caches OCSP responses in advance and returns them to browsers during TLS handshakes. As a result, browsers do not need to query CAs for certificate status, reducing the time required for validation.

• When OCSP stapling is disabled, each visitor to the website sends a query for OCSP, affecting page loading on browsers. A large number of concurrent requests bring great pressure to CA servers.
• When OCSP stapling is enabled, CDN queries and caches verification results of online certificates in advance. Users do not need to send requests to CAs. They only need to verify the validity of the cached results. This improves the TLS handshake efficiency and reduces the verification time.

  

Constraints

• An international HTTPS certificate has been configured. For details, see Configuring an HTTPS Certificate.
  • Disabling the HTTPS certificate will disable OCSP stapling.
  • After configuring the HTTPS certificate, wait about 5 minutes for the configuration to complete and then enable OCSP stapling.
• If you change the certificate type from International to Chinese (SM2), OCSP stapling will become invalid.
• If you configure two certificates for a domain name, OCSP stapling takes effect only for the international certificate.

Procedure

1. Log in to the CDN console.
2. In the navigation pane, choose Domains.
3. In the domain list, click the target domain name. The Overview page is displayed.
4. In the full configuration directory, click the HTTPS Settings tab.
5. Switch on OCSP Stapling.
   Figure 1 OCSP stapling
   

Helpful Links

• Modifying OCSP stapling settings via an API: Modifying the Full Domain Configuration
• Configuring an HTTPS Certificate