OTL-1009 - TLS Certificate Revocation Monitoring via OCSP Stapling and Local Probes

Living Document Notice
Published 2026-09-18. The evolving architecture, revisions, and connected notes for this dispatch live in the Stax Digital Garden.

TLS Certificate Revocation Monitoring via OCSP Stapling and Local Probes

Summary

Expired or improperly stapled OCSP responses cause unexpected browser handshake drops that confuse operators and degrade sync client uptime in Harbor edge runtime. Implementing automated pre-expiry OCSP fetch verification inside the edge reverse proxy ensures valid stapled tokens are cached and renewed before client TLS handshakes fail.

The Failure Mode of Real-Time Revocation Checks

Online Certificate Status Protocol (OCSP) allows clients to verify that an X.509 certificate has not been revoked prior to its scheduled expiration. However, requiring client browsers or sync daemons to query Certificate Authority (CA) OCSP responders directly introduces external network latency and leaks user browsing metadata.

OCSP Stapling (RFC 6066) shifts this burden to the web server. The reverse proxy periodically queries the CA’s OCSP responder, signs and caches the assertion, and delivers (“staples”) the status directly into the TLS CertificateStatus handshake message. If the web server fails to refresh this cached response, or if the CA responder suffers downtime, clients enforcing strict revocation checking reject the handshake with SEC_ERROR_OCSP_OLD_RESPONSE.

+-------------------------------------------------------------+
|                OCSP Stapling Lifecycle Flow                 |
|                                                             |
|   [CA OCSP Responder]                                       |
|           | (Periodic background fetch every 4 hours)       |
|           v                                                 |
|   [Edge Reverse Proxy: NGINX / Envoy]                       |
|           |                                                 |
|           +---> Cache signed OCSP response to disk / memory |
|           |                                                 |
|   [Incoming Client Handshake (ClientHello + status_request)]|
|           |                                                 |
|           v                                                 |
|   [ServerHello + Certificate + Stapled OCSP Response]       |
|           |                                                 |
|           v                                                 |
|   [Client Validates: Signature + NextUpdate Window]         |
+-------------------------------------------------------------+

Edge Proxy Stapling Configuration

Configure NGINX to resolve OCSP responders asynchronously, staple valid responses, and enforce DNS resolver timeouts:

# /etc/nginx/conf.d/tls-stapling.conf
server {
    listen 443 ssl http2;
    server_name api.bosunpkm.com;
 
    ssl_certificate /etc/letsencrypt/live/api.bosunpkm.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/api.bosunpkm.com/privkey.pem;
 
    # Enable OCSP Stapling with verified certificate chain
    ssl_stapling on;
    ssl_stapling_verify on;
    ssl_trusted_certificate /etc/letsencrypt/live/api.bosunpkm.com/chain.pem;
 
    # Local recursive resolver with tight lookup timeout
    resolver 127.0.0.1 1.1.1.1 valid=300s;
    resolver_timeout 3s;
 
    # Session cache and tickets
    ssl_session_timeout 1d;
    ssl_session_cache shared:SSL:10m;
    ssl_session_tickets off;
}

Validating Stapled Responses with OpenSSL

Verify that the proxy correctly transmits a valid, non-expired OCSP token during client handshakes:

# Execute TLS handshake requesting certificate status
$ openssl s_client -connect api.bosunpkm.com:443 -servername api.bosunpkm.com -status -tlsextdebug < /dev/null 2>&1 |     awk '/OCSP response:/,/This Update/'
 
# Expected Valid Output:
OCSP response: 
======================================
OCSP Response Data:
    OCSP Response Status: successful (0x0)
    Response Type: Basic OCSP Response
    Version: 1 (0x0)
    Responder Id: C = US, O = Let's Encrypt, CN = R3
    Produced At: Sep 17 08:00:12 2026 GMT
    Responses:
    Certificate ID:
      Hash Algorithm: sha1
      Issuer Name Hash: 7EE6A3E520D2635B4F691D90A11814B69D7B7B12
      Issuer Key Hash: A84A6A63047DD1BBAE77D39C7B67CE72C147D2B3
      Serial Number: 03B8D8F4E64A12B889C4
    Cert Status: good
    This Update: Sep 17 08:00:12 2026 GMT
    Next Update: Sep 24 08:00:12 2026 GMT

Proactive OCSP Staleness Monitor

If the upstream CA responder experiences sustained downtime, the Next Update timestamp in the cached staple will drift into the past. This shell monitor alerts before the staple expires:

#!/usr/bin/env bash
set -euo pipefail
 
TARGET_HOST="api.bosunpkm.com"
PORT="443"
 
STATUS_OUTPUT=$(openssl s_client -connect "${TARGET_HOST}:${PORT}"     -servername "${TARGET_HOST}" -status < /dev/null 2>&1)
 
if ! echo "$STATUS_OUTPUT" | grep -q "OCSP Response Status: successful"; then
    echo "CRITICAL: OCSP response missing or unsuccessful from ${TARGET_HOST}" >&2
    exit 2
fi
 
NEXT_UPDATE_RAW=$(echo "$STATUS_OUTPUT" | grep "Next Update:" | head -n1 | cut -d: -f2- | xargs)
NEXT_UPDATE_EPOCH=$(date -d "$NEXT_UPDATE_RAW" +%s)
CURRENT_EPOCH=$(date +%s)
DIFF_HOURS=$(( (NEXT_UPDATE_EPOCH - CURRENT_EPOCH) / 3600 ))
 
echo "OCSP Staple for ${TARGET_HOST} valid until: ${NEXT_UPDATE_RAW} (${DIFF_HOURS} hours remaining)"
 
if [ "$DIFF_HOURS" -lt 24 ]; then
    echo "WARNING: OCSP staple expires in less than 24 hours!" >&2
    exit 1
fi

Automated verification of OCSP staple validity prevents silent connection drops and preserves zero-trust transport guarantees across all edge nodes.

---

• Directus Target: on-the-line
• Garden Source Reference: tls-certificate-revocation-monitoring-via-ocsp-stapling-and-local-probes, x509-validation, nginx-ssl-configuration, edge-ingress, MOC - Fleet Operations, MOC - Bosun PKM Tools, MOC - Harbor Ecosystem