Nginx; how to use OCSP to verify the SSL client certificate

Question

I am using Nginx to create a secure connection; when I revoked the client certificate, I also can connect to Nginx by https, I know I should config the ssl_crl directives, but I want to use OCSP to verify the client certificate, How should I do? I found Nginx use OpenSSL library to establish ssl connection, Is there something I should do with openssl.cnf file?

Answer 1

Client certificate validation with OCSP feature has been added to nginx 1.19.0+. For example:

ssl_verify_client on;
ssl_ocsp on;
resolver 192.0.2.1;

ssl_ocsp enables OCSP validation of the client certificate chain.
ssl_ocsp leaf; enables validation of the client certificate only. By default ssl_ocsp is set to off. ssl_verify_client directive should be set to on or optional for the OCSP validation to work resolver should be specified to resolve the OCSP responder hostname.