OCSP Stapling Explained (and Why It Is Optional)

The problem with plain OCSP

When a browser receives a certificate, it can query the CA's OCSP responder to check whether the certificate was revoked. That request is a separate connection to a third party, adds latency, and reveals which site the visitor is connecting to — before the page has even loaded.

If the responder is slow or unreachable, browsers either fail open (ignore the check) or fail closed (block the site), depending on the client. Neither is good.

What stapling changes

With stapling, the server fetches the signed OCSP response itself, caches it, and attaches it to the TLS handshake. The browser gets the revocation answer without contacting anyone else, so there is no extra round trip and no leak.

It also removes the dependency on the CA being reachable from the visitor's network, which matters in regions where OCSP responders are intermittently blocked.

Enabling and verifying it

On nginx, stapling needs a resolver and the chain file, otherwise it silently does nothing. On Apache, the cache directive has to be at server level. After reloading, verify from outside — a config line that is present but not working looks identical to one that is missing.

# nginx
ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /etc/letsencrypt/live/example.com/chain.pem;
resolver 1.1.1.1 8.8.8.8 valid=300s;

# verify from outside — look for a stapled response, not just "OCSP response: none"
openssl s_client -connect example.com:443 -status -servername example.com </dev/null 2>/dev/null | grep -A3 "OCSP Response Status"

Why it is not required for A+

Stapling is a privacy and latency improvement, not a protocol strength. A server that does not staple is not less secure in the way that a server offering TLS 1.0 is. CertH treats it as a positive signal in the configuration health section but does not require it for the top grade.

That said, it is one of the cheapest wins available: two lines of configuration, no client impact, and a measurable privacy gain for every visitor.

FAQ