OCSP Stapling: Faster Revocation Checks

Introduction

OCSP, or Online Certificate Status Protocol, lets clients check whether an SSL/TLS certificate has been revoked before it expires. OCSP stapling improves this process by allowing the web server to attach a recent certificate status response during the TLS handshake.

Without stapling, a browser may need to contact the certificate authority’s OCSP responder separately. With stapling, the server provides the revocation status directly, which can reduce extra network requests and improve privacy.

Quick answer

What is OCSP?

OCSP stands for Online Certificate Status Protocol. It is used to check whether an SSL/TLS certificate has been revoked before its normal expiration date.

• The private key was compromised
• The certificate was issued incorrectly
• The domain owner requested revocation
• The certificate authority found a problem
• The certificate should no longer be trusted

OCSP stapling

OCSP stapling allows the server to fetch a signed OCSP response from the certificate authority and “staple” it to the TLS handshake. The browser can then verify the stapled response without making a separate request to the CA’s OCSP server.

Browser → Website
Browser → CA OCSP responder

Browser → Website, and website includes OCSP status

Why it exists

OCSP stapling exists to make certificate revocation checks more efficient.

• Fewer extra browser requests
• Faster TLS handshake in some cases
• Less dependency on CA OCSP responder availability
• Improved user privacy
• Cleaner SSL/TLS security scans
• Better behavior for high-traffic HTTPS sites

Privacy

Without stapling, a browser may contact the certificate authority’s OCSP responder to ask about the certificate status. This can reveal that a user is visiting a particular certificate or site.

With stapling, the server provides the OCSP response directly, so the browser usually does not need to contact the CA for that check.

When it matters

Why this matters

However, OCSP stapling is not a cure-all. It will not fix an invalid certificate, expired certificate, wrong hostname, incomplete chain or mixed content.

How to check OCSP

Use SSL Checker or OpenSSL to check whether the server sends a stapled OCSP response.

Common problems

How to enable it

1. Step 1: Confirm certificate and chain are valid

   Fix certificate expiry, hostname mismatch and incomplete chain before focusing on OCSP stapling.

2. Step 2: Identify where HTTPS terminates

   Check whether TLS is served by hosting, Nginx, Apache, LiteSpeed, CDN, reverse proxy or load balancer.

3. Step 3: Enable OCSP stapling where supported

   Use your web server, hosting panel or CDN SSL/TLS settings.

4. Step 4: Allow outbound OCSP access

   Make sure the server can resolve DNS and reach the certificate authority’s OCSP responder.

5. Step 5: Reload the service

   Reload Nginx, Apache, LiteSpeed, CDN configuration or proxy service after changes.

6. Step 6: Re-test externally

   Use SSL Checker or OpenSSL to confirm a stapled OCSP response is present.

7. Step 7: Monitor renewal and chain changes

   After certificate renewal, confirm OCSP stapling still works.

Nginx and Apache

OCSP stapling is commonly configured in web server SSL settings.

ssl_stapling on;
ssl_stapling_verify on;

SSLUseStapling on

CDN behavior

When a CDN is used, visitors usually connect to the CDN edge certificate. In that case, OCSP stapling may be controlled by the CDN rather than the origin server.

• Public CDN hostname
• CDN edge certificate
• Origin certificate separately if needed
• CDN SSL/TLS settings
• Whether the CDN automatically manages OCSP stapling

Check examples

openssl s_client -connect example.com:443 -servername example.com -status

Look for:
OCSP response: no response sent

or:
OCSP Response Status: successful

openssl s_client -connect example.com:443 -servername example.com -showcerts

curl -I https://example.com

ssl_stapling on;
ssl_stapling_verify on;

SSLUseStapling on

Frequently asked questions