# nginx: [emerg] SSL: OCSP stapling verify failed (SSL: error:2707307E:OCSP routines:OCSP_basic_verify:certificate verify error) while verifying certificate

- **ID:** `nginx/ssl-ocsp-stapling-verify-failed`
- **Domain:** nginx
- **Category:** auth_error
- **Verification:** ai_generated
- **Fix Rate:** 90%

## Root Cause

OCSP stapling fails because the certificate chain is incomplete or the OCSP responder certificate is not trusted by nginx's CA bundle.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| nginx/1.18.0 | active | — | — |
| nginx/1.20.0 | active | — | — |
| nginx/1.24.0 | active | — | — |
| nginx/1.26.0 | active | — | — |

## Workarounds

1. **Ensure the full certificate chain (including intermediate CA) is specified in ssl_certificate: `cat server.crt intermediate.crt > fullchain.crt` and set `ssl_certificate /path/to/fullchain.crt;`** (90% success)
   ```
   Ensure the full certificate chain (including intermediate CA) is specified in ssl_certificate: `cat server.crt intermediate.crt > fullchain.crt` and set `ssl_certificate /path/to/fullchain.crt;`
   ```
2. **Set ssl_trusted_certificate to the CA bundle that includes the OCSP responder's issuer: `ssl_trusted_certificate /etc/ssl/certs/ca-bundle.crt;`** (85% success)
   ```
   Set ssl_trusted_certificate to the CA bundle that includes the OCSP responder's issuer: `ssl_trusted_certificate /etc/ssl/certs/ca-bundle.crt;`
   ```
3. **If using Let's Encrypt, use the fullchain.pem file: `ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;`** (95% success)
   ```
   If using Let's Encrypt, use the fullchain.pem file: `ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;`
   ```

## Dead Ends

- **** — Without verification, nginx will staple any OCSP response, including potentially forged ones, weakening TLS security. (50% fail)
- **** — The responder's certificate must be in the trusted store; changing the URL does not fix trust issues. (70% fail)
- **** — OCSP responses are signed by the CA, not the server certificate; the CA's certificate must be in the trust chain. (60% fail)