---
title: "WEB-NGX-005 nginx OCSP Stapling Off or Session Tickets On"
canonical: https://openvapt.com/checks/WEB-NGX-005.html
html: https://openvapt.com/checks/WEB-NGX-005.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-14
version: 0.1.0-alpha.6
---

# WEB-NGX-005 nginx OCSP Stapling Off or Session Tickets On

A TLS-enabled nginx does not enable ssl_stapling, or leaves ssl_session_tickets on.

- Domain: Web Apps
- Severity: Low
- Control category: Cryptography and TLS
- Fix effort: low
- CVSS v3.1 vector: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N`
- CIS Controls v8: 3.10
- NIST CSF 2.0: PR.DS-02
- CWE: CWE-299, CWE-326
- OWASP Top 10 2021: A02:2021
- OWASP ASVS 4.0.3: 9.2.4
- OWASP WSTG v4.2: WSTG-CRYP-01
- NIST SP 800-53 Rev. 5: SC-8, SC-17
- Benchmark topic: Certificate status checking and session resumption (topic only, no benchmark text)

## Why It Matters

Without stapling, every browser asks the certificate authority whether the certificate is revoked, which slows the handshake and leaks the visited site to the CA. Session tickets encrypted with a long-lived key weaken forward secrecy when the key is never rotated; the Mozilla profiles turn them off.

## How It Detects

When TLS is configured, reads ssl_stapling, ssl_stapling_verify and ssl_session_tickets. Fails unless ssl_stapling is on and ssl_session_tickets is off.

## How to Fix

Add  ssl_stapling on; ssl_stapling_verify on; ssl_session_tickets off;  and a  resolver  directive, as the Mozilla generator produces.

## How to Verify

```
openssl s_client -connect 127.0.0.1:443 -servername <site> -status  should print OCSP Response Status: successful.
```

## Learn the Theory

- [P18 Web Server Hardening: nginx and Apache](https://openvapt.com/academy/p18.md)

## References

- [Mozilla SSL Configuration Generator](https://ssl-config.mozilla.org/)
- [nginx documentation, ngx_http_ssl_module](https://nginx.org/en/docs/http/ngx_http_ssl_module.html)

## Source Code

https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/serverconf.go

Run it: `openvapt scan --only WEB-NGX-005`. Read it offline: `openvapt explain WEB-NGX-005`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/checks/WEB-NGX-005.html. Part of OpenVAPT Check Catalogue. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.