OCSP Stapling

OCSP Stapling (the TLS Certificate Status Request extension) allows a server to fetch and cache an OCSP response from the certificate authority, then send it ("staple" it) to clients during the TLS handshake. This eliminates the client's need to make a separate request to check certificate revocation status.

Normally, clients would query the OCSP responder independently to verify the certificate isn't revoked. This adds latency and external dependencies. With stapling, the server performs the OCSP check once and bundles the signed response with the certificate chain, speeding up the handshake and removing a potential point of failure.

How it works:

1. Server periodically requests an OCSP response from the CA (e.g., every few days).
2. Server caches the response and includes it in the TLS handshake (status_request extension).
3. Client validates the cached OCSP response during the handshake—no separate lookup needed.
4. If the response expires, the server fetches a fresh one from the CA.

Benefits:

• Faster TLS handshakes (no blocking OCSP query).
• Reduced load on OCSP responders.
• Better privacy—OCSP queries aren't logged by the CA server.
• Improved reliability if the OCSP responder is temporarily unavailable.

TipEnsure your server is configured to refresh OCSP responses regularly (typically every 24–48 hours before expiry) to avoid serving stale revocation data.

Stapling is now widely supported across modern browsers and servers, and is considered a best practice for HTTPS deployments.