Issue Potential issue with OCSP stapling

[Janko Falli]

At "SSL/TLS Certificate for..." the box "OCSP Stapling" is still present (Plesk Obsidian 18.0.75 Web Host Edition) by default is disabled but if
ssl_stapling on;
ssl_stapling_verify on;
are present it turns green with enabled state.
The error is what OP posted:
nginx: [warn] "ssl_stapling" ignored, no OCSP responder URL in the certificate "/usr/local/psa/var/certificates/....
All certificates ar from SSL it extension at plesk

 

[Sebahat.hadzhi]

Thank you for the update. This is somehow expected. The ability to enable OCSP Stapling hasn't been completely excluded. However, the option should be greyed out if the installed certificate does not include the required URL. What SSL certificates are you using? Are there any steps to reproduce you can share with me so I can double-check whether I will be able to replicate the issue on a test environment? Thank you in advance.

 

[Janko Falli]

Може да отговориш така (ясно и технически коректно):

---

When the certificate is installed, the OCSP Stapling option in the UI is greyed out, which is expected. However, if I manually add:
ssl_stapling on;
ssl_stapling_verify on;
under Apache & nginx Settings → Additional nginx directives, the option indicator turns green in the interface.

So from the UI perspective everything looks enabled and functional until I accidentally noticed the warning:
nginx: [warn] "ssl_stapling" ignored, no OCSP responder URL in the certificate

I assumed OCSP stapling was working correctly, because the UI shows it as enabled (green status).
Reproduction steps:

1. Install a Let’s Encrypt certificate.
2. Leave OCSP stapling disabled (option greyed out).
3. Manually add:
   ssl_stapling on;
   ssl_stapling_verify on;
   in Additional nginx directives.
4. The UI indicator turns green.
5. Check nginx error log -> warning about missing OCSP responder URL.

So the issue is not that stapling cannot be enabled but it’s that the UI reflects configuration directives, not actual runtime capability, which can be misleading when the certificate lacks an OCSP responder URL.

---