cis-nginx-v300-4-1-7

name	cis-nginx-v300-4-1-7
description	Ensure Online Certificate Status Protocol (OCSP) stapling is enabled (Manual)
category	cis-nginx
version	3.0
author	cyberstrike-official
tags	["cis","nginx","web-server","reverse-proxy","tls-ssl","encryption"]
cis_id	4.1.7
cis_benchmark	CIS NGINX Benchmark v3.0.0
tech_stack	["nginx","linux","web-server"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

CIS 4.1.7 — Ensure Online Certificate Status Protocol (OCSP) stapling is enabled

Profile Applicability

• Level 1 - Webserver
• Level 1 - Proxy
• Level 1 - Loadbalancer

Description

OCSP stapling allows a server to efficiently deliver certificate revocation information to the client, improving performance and privacy. The server caches the OCSP response from the Certificate Authority (CA), eliminating the need for the client to make a separate connection. For robust security, certificates should be issued with the OCSP Must-Staple extension, which transforms the traditional "soft-fail" behavior into a "hard-fail," ensuring clients always receive and validate a current revocation status.

Rationale

OCSP stapling is a critical mechanism for distributing certificate revocation status. Without it, clients might not be aware that a server's certificate has been compromised, allowing for potential man-in-the-middle attacks. The OCSP Must-Staple extension is essential as it mitigates the inherent weakness of optional OCSP ("soft-fail"), where a browser might proceed with a connection if it doesn't receive a staple. By enforcing a "hard-fail", Must-Staple ensures that a compromised certificate can be reliably blocked.

Impact

If OCSP Must-Staple is used, a misconfiguration on the server (e.g., a firewall blocking outbound OCSP queries, an incorrect DNS resolver) will cause clients to reject the certificate and refuse to connect, leading to a service outage. This "hard-fail" behavior is intentional for security but requires diligent configuration and monitoring of the OCSP stapling mechanism.

Audit Procedure

Run the following command to inspect the fully loaded NGINX configuration for the four required directives:

nginx -T 2>/dev/null | grep -E \
'^\s*(ssl_stapling|ssl_stapling_verify|ssl_trusted_certificate|resolver)'

Verify that the output contains the following directives with appropriate values within the relevant http or server blocks:

• ssl_stapling on;
• ssl_stapling_verify on;
• ssl_trusted_certificate /path/to/your/chain.pem;
• resolver A.B.C.D;

If any of these four directives are missing, this recommendation is not fully implemented.

Remediation

Follow this procedure to enable a robust OCSP stapling configuration:

1. When issuing a certificate, request that the OCSP Must-Staple extension be included.
2. Edit your NGINX configuration to include all four necessary directives. The must point to a file containing your root and intermediate certificates. The resolver must be set to one or more trusted DNS resolvers.