All tools

Guides Certificates

nginx “ssl_stapling” ignored, no OCSP URL

Updated 4 min read

Short answer

The warning is harmless: your certificate has no OCSP address, so nginx has nothing to staple. Let’s Encrypt stopped putting OCSP addresses in certificates on May 7, 2025, and switched its OCSP service off on August 6, 2025.

What to do: remove ssl_stapling and ssl_stapling_verify from servers that use Let’s Encrypt certificates. Keep them where the certificate still lists an OCSP address.

The SSL certificate checker shows the certificate your site serves, who issued it and when it expires, as seen from our server rather than your browser. Free, no account. Check a certificate

The full warning looks like this, with the path of your certificate at the end:

2026/10/24 03:00:29 [warn] 177#177: "ssl_stapling" ignored, no OCSP responder URL in the certificate "/etc/nginx/test-certs/fullchain.pem"
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

We captured it on October 24, 2026 with nginx -t in a Debian 13 test container (nginx 1.26.3), using a test certificate that, like every Let’s Encrypt certificate issued since May 7, 2025, has no OCSP address. It is a warning, not an error: the test passes and nginx serves the site. In nginx’s source, the check finds no OCSP address in the certificate, logs this at the warn level and skips stapling for that certificate (ngx_event_openssl_stapling.c).

Remove the stapling lines

Find them first. They may be in a site’s server block, a shared snippet, or nginx.conf:

sudo grep -rn ssl_stapling /etc/nginx/
/etc/nginx/conf.d/example.conf:6:    ssl_stapling        on;
/etc/nginx/conf.d/example.conf:7:    ssl_stapling_verify on;

Delete both lines, then test and reload:

sudo nginx -t && sudo systemctl reload nginx
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

The warning is gone. An ssl_trusted_certificate line next to them can stay or go: nginx uses that file only “to verify client certificates and OCSP responses if ssl_stapling is enabled” (nginx SSL module). A resolver line may be there for stapling too; keep it if anything else in your configuration needs DNS lookups.

If the same nginx serves certificates from several CAs, keep stapling in the server blocks whose certificate still has an OCSP address, and remove it from the rest.

Where the lines came from

Often from Certbot. Its --staple-ocsp option adds exactly three lines to the server block: ssl_trusted_certificate, ssl_stapling on and ssl_stapling_verify on (the nginx installer in Certbot’s source). Certbot doesn’t add them again at renewal, so deleting them is enough. Hardening guides and configuration generators also include them.

Check a certificate for an OCSP address

openssl x509 -ocsp_uri prints a certificate’s OCSP address, or nothing when there isn’t one. This asks three sites, each with a certificate from a different CA:

for host in letsencrypt.org www.digicert.com www.sectigo.com; do
  uri=$(echo | openssl s_client -connect "$host:443" \
      -servername "$host" 2>/dev/null | openssl x509 -noout -ocsp_uri)
  printf '%-18s %s\n' "$host" "${uri:-(no OCSP URL)}"
done
letsencrypt.org    (no OCSP URL)
www.digicert.com   http://ocsp.digicert.com
www.sectigo.com    http://ocsp.sectigo.com

Captured on October 24, 2026 with OpenSSL 3.6.4. DigiCert and Sectigo certificates still carry an OCSP address, so stapling still works for them. For a certificate file on your server, run openssl x509 -in /etc/letsencrypt/live/example.com/cert.pem -noout -ocsp_uri with your own path.

Why the address is gone

Let’s Encrypt announced the end of OCSP on December 5, 2024, citing privacy: an OCSP request tells the CA “which website is being visited from that visitor’s particular IP address” (Ending OCSP Support in 2025). Its timeline:

  • May 7, 2025: “we will drop OCSP URLs from certificates.” Certificates carry a revocation list (CRL) address instead.
  • August 6, 2025: “we will turn off our OCSP responders.” On that day it reported that every certificate that had contained an OCSP address had expired (OCSP Service Has Reached End of Life).

The rules allow it. The CA/Browser Forum Baseline Requirements, which every publicly trusted CA follows, made OCSP optional and CRLs mandatory with ballot SC063, effective March 15, 2024. In version 2.3.1, an OCSP address in a subscriber certificate is listed as “MAY” (section 7.1.2.7.7). Revocation information now comes from the CRL. What is lencr.org shows the CRL address in a Let’s Encrypt certificate.

Also check for Must-Staple

Must-Staple is a certificate extension that told browsers to refuse a connection without a stapled OCSP answer. Let’s Encrypt ended it with OCSP: from May 7, 2025, “all requests including the OCSP Must Staple extension will fail.” If you once got a certificate with Certbot’s --must-staple option, its renewal settings still ask for it, and renewal fails until you remove it. Look for it:

sudo grep -r must_staple /etc/letsencrypt/renewal/

A line reading must_staple = True means that certificate won’t renew. Delete the line, then run sudo certbot renew --dry-run to confirm. Certbot renew failed explains the error types if it doesn’t pass.

Sources

All sources were checked on October 24, 2026. The nginx output comes from our own run in a test container, and the OpenSSL output from our own run, on that date.

Keep reading