{"id":17527056,"url":"https://github.com/tomwassenberg/certbot-ocsp-fetcher","last_synced_at":"2026-07-23T06:03:17.251Z","repository":{"id":53790444,"uuid":"101064897","full_name":"tomwassenberg/certbot-ocsp-fetcher","owner":"tomwassenberg","description":"A tool that primes the OCSP cache of nginx for certificates managed by Certbot, in order to make OCSP stapling work reliably.","archived":false,"fork":false,"pushed_at":"2026-04-07T18:28:09.000Z","size":223,"stargazers_count":34,"open_issues_count":2,"forks_count":4,"subscribers_count":1,"default_branch":"main","last_synced_at":"2026-07-20T20:29:23.940Z","etag":null,"topics":["certbot","nginx","ocsp","ocsp-stapling"],"latest_commit_sha":null,"homepage":"","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/tomwassenberg.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2017-08-22T13:17:32.000Z","updated_at":"2026-07-08T09:27:52.000Z","dependencies_parsed_at":"2023-01-28T01:15:36.365Z","dependency_job_id":null,"html_url":"https://github.com/tomwassenberg/certbot-ocsp-fetcher","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/tomwassenberg/certbot-ocsp-fetcher","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tomwassenberg%2Fcertbot-ocsp-fetcher","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tomwassenberg%2Fcertbot-ocsp-fetcher/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tomwassenberg%2Fcertbot-ocsp-fetcher/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tomwassenberg%2Fcertbot-ocsp-fetcher/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/tomwassenberg","download_url":"https://codeload.github.com/tomwassenberg/certbot-ocsp-fetcher/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tomwassenberg%2Fcertbot-ocsp-fetcher/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35791282,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-07-20T02:08:10.276Z","status":"online","status_checked_at":"2026-07-23T02:00:06.683Z","response_time":57,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["certbot","nginx","ocsp","ocsp-stapling"],"created_at":"2024-10-20T15:03:01.348Z","updated_at":"2026-07-23T06:03:17.229Z","avatar_url":"https://github.com/tomwassenberg.png","language":"Shell","funding_links":[],"categories":["Shell"],"sub_categories":[],"readme":"# certbot-ocsp-fetcher\n`certbot-ocsp-fetcher` helps you setup OCSP stapling in nginx. The tool primes\nnginx's OCSP cache to work around nginx's flawed OCSP stapling implementation\n(see bug [#812]). The tool does this by fetching and saving OCSP responses for\nTLS certificates issued with [Certbot].\n\nIn order for all this to be useful, you should know how to set up OCSP stapling\nin nginx. For this, you can take a look at [Mozilla's SSL Configuration\nGenerator] for instance. If you use Certbot's `nginx` plugin, you can also add\nthe `--staple-ocsp` flag to your `certbot --nginx` command(s) to configure OCSP\nstapling.\n\nThe tool works by utilizing the OCSP Responder URL embedded in a certificate\nand saving the OCSP responses in staple files. These staple files can be\nreferenced in the nginx configurations of the websites that use the\ncertificates. The tool can behave in two ways:\n\n- Certbot can invoke the tool as a deploy/renew hook (possible in Certbot\n  \\\u003e=0.17.0). In this case, the tool ensures an up-to-date OCSP staple file is\n  present on disk for the specific certificate that was issued using Certbot.\n\n- You can invoke the tool directly. In this case, the tool cycles through all\n  sites that have a certificate lineage in Certbot's folder and ensures an\n  up-to-date OCSP staple file is present on disk.\n\nThe use of this tool makes sure OCSP stapling in nginx works reliably. As a\nconsequence, this allows you to use [OCSP Must-Staple].\n\n**Do note that Let's Encrypt has [announced][LE-OCSP-deprecation] that it will\nstop supporting OCSP Must-Staple at 2025-05-07, and retire their OCSP responders\n_completely_ on 2025-08-06.**\n\n## Dependencies\n- Bash 4.3+\n- Certbot 0.5.0+\n- nginx (tested with 1.14.0)\\\n  Optional if `--no-reload-webserver` (see below) is passed.\n- OpenSSL 1.1.0+\n- BSD's `column`\\\n  Optional. For machine-readable TSV output, the version needs to support the\n  `--output-separator` flag. This is satisfied in e.g. Debian 11 and Ubuntu\n  20.10+.\n\nFor running the tests, [Bats] is also required.\n\n## Usage\nInvoke the tool as follows:\n\n`# ./certbot-ocsp-fetcher [OPTION]...`\n\nThe filename of a resulting OCSP staple is the name of the certificate lineage\n(as used by Certbot) with the `der` extension appended. Be sure to point nginx\nto the staple file(s) by using the `ssl_stapling_file` directive in the nginx\nconfiguration of the website. For instance, by including: `ssl_stapling_file\n/var/cache/certbot-ocsp-fetcher/example.com.der;`, where\n`/var/cache/certbot-ocsp-fetcher` is the default output directory when using\nthe [supplied systemd service].\n\nInvoke the tool with privileges that allow it to access the directory that\nCertbot stores its certificates in (by default `/etc/letsencrypt/live`). You\nshould run the tool daily, for instance by one of the following options:\n\n- using the included systemd service + timer\n- adding an entry for the tool to the user's crontab\n\nAs mentioned above, you can use this tool as a deploy hook for Certbot. To do\nthis, append `--deploy-hook \"/path/to/certbot-ocsp-fetcher\"` to the Certbot\ncommand you currently use when requesting a certificate.\n\n**Note:** If an existing OCSP staple file is still valid for more than half of\nits lifetime, it will **not** be updated. If you need to override this\nbehavior, use the`-f/--force-update` flag (see below).\n\n### Command line options\nThis is a listing of all the command line options that can be passed to the\ntool:\n\n- `-c DIRECTORY, --certbot-dir=DIRECTORY`\\\n  Specify the configuration directory of the Certbot instance that is used to\n  process the certificates. When not specified, this defaults to\n  `/etc/letsencrypt`.\\\n  This flag cannot be used when the tool is invoked as a deploy hook by\n  Certbot. In that case, the tool infers the path to Certbot's configuration\n  directory and the certificate from Certbot's invocation of the tool.\n\n- `-f, --force-update`\\\n  Replace possibly existing valid OCSP responses in staple files on disk by\n  fresh responses from the OCSP responder.\\\n  This flag cannot be used when Certbot invokes the tool as a deploy hook.\n\n- `-h, --help`\\\n  Print the correct usage of the tool.\n\n- `-l, --no-color`\\\n  Do not use colored text output. This applies to both stdout and stderr. By\n  default, the tool's output might use color, as long as none of the following\n  conditions are true:\n    - no TTY is attached to the file descriptor in question\n    - [`$NO_COLOR`] is set\n    - `$TERM` is set to `dumb`\n\n- `-n NAME, --cert-name=NAME`\\\n  Specify the name of the certificate lineage(s) (as used by Certbot) that you\n  want to process. Express multiple lineages by delimiting these with a comma,\n  or specify the flag multiple times. When not specified, the tool processes\n  all certificate lineages in Certbot's configuration directory.\\\n  This flag cannot be used when the tool is invoked as a deploy hook by\n  Certbot.\n\n- `-u URL, --ocsp-responder=URL` \\\n  Specify the URL of the OCSP responder to query for the certificate lineage(s)\n  that were specified *directly* before this flag on the command line. This is\n  required when the certificate in question does not use the AIA extension to\n  include the OCSP responder of its issuer. For instance, you could invoke the\n  command as follows: `./certbot-ocsp-fetcher --cert-name\n  1.example.com,2.example.com --ocsp-responder ocsp.ca.example.com`\n\n- `-o DIRECTORY, --output-dir=DIRECTORY`\\\n  Specify the directory where OCSP staple files are saved. When not specified,\n  this defaults to the `$CACHE_DIRECTORY` environment variable, as is set by\n  the [supplied systemd service]. If this environment variable is not set\n  either, this defaults to the working directory.\n\n- `-q, --quiet`\\\n  Do not print any output, including the list of certificates the tool\n  processed and the actions the tool took.\n  This flag and the `-v/--verbose` flag are mutually exclusive.\n\n- `-v, --verbose`\\\n  Makes the tool verbose by printing specific (error) messages. These messages\n  can be used for debugging purposes. Specify this flag multiple times for more\n  verbosity.\n  This flag and the `-q/--quiet` flag are mutually exclusive.\n\n- `-w, --no-reload-webserver`\\\n  Do not reload `nginx`. When not specified and the tool created or updated at\n  least one OCSP staple file, the tool will attempt to reload `nginx`.\n\n## Distribution\n\n* Upstream: https://github.com/tomwassenberg/certbot-ocsp-fetcher\n\nThe channels below are not maintained by me.\n\n* Arch Linux: https://aur.archlinux.org/packages/certbot-ocsp-fetcher-git/\n* Debian: we are looking for a packager\n* Ubuntu: we are looking for a packager\n\n [Certbot]: https://github.com/certbot/certbot\n [#812]: https://trac.nginx.org/nginx/ticket/812\n [Mozilla's SSL Configuration Generator]: https://mozilla.github.io/server-side-tls/ssl-config-generator/\n [OCSP Must-Staple]: https://scotthelme.co.uk/ocsp-must-staple/\n [LE-OCSP-deprecation]: https://letsencrypt.org/2024/12/05/ending-ocsp/\n [Bats]: https://github.com/bats-core/bats-core\n [supplied systemd service]: systemd-units/certbot-ocsp-fetcher.service#11\n [`$NO_COLOR`]: https://no-color.org/\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftomwassenberg%2Fcertbot-ocsp-fetcher","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ftomwassenberg%2Fcertbot-ocsp-fetcher","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftomwassenberg%2Fcertbot-ocsp-fetcher/lists"}