What is OCSP Stapling?
OCSP Stapling lets a TLS server present a fresh, signed OCSP response during the handshake, so clients verify certificate revocation without contacting the CA directly.
OCSP Stapling is a TLS extension that allows a server to include a time-stamped OCSP (Online Certificate Status Protocol) response from the certificate authority (CA) as part of the TLS handshake. Instead of the client sending a separate OCSP request to the CA to check if the server's certificate has been revoked, the server proactively fetches and caches a signed OCSP response and attaches it to the CertificateStatus message. This response is typically valid for a short period (e.g., a few days) and must be refreshed regularly by the server.
The mechanism works as follows. During the TLS handshake, after the server sends its certificate, it may send a CertificateStatus message containing the OCSP response. The client then validates the response against the CA's public key and checks the timestamp and revocation status. If the response is valid and shows the certificate is not revoked, the handshake proceeds. If the response is missing, expired, or invalid, the client may either fetch OCSP directly or abort the connection, depending on its policy. OCSP Stapling is defined in RFC 6066 and extended by RFC 6961 to support multiple certificate statuses.
OCSP Stapling sits within the TLS protocol as an optional extension, commonly used in HTTPS deployments. It reduces latency by eliminating the client's round trip to the CA and improves privacy because the CA no longer learns which websites a client visits. It is supported in TLS 1.2 and TLS 1.3. Many modern web servers and CDNs implement OCSP Stapling, often combined with the Must-Staple extension to enforce its use. The technique is a key part of reducing the performance and privacy costs of certificate revocation checking.
Key facts
- Defined in RFC 6066 and extended by RFC 6961 for multiple certificate statuses.
- Eliminates the need for clients to make separate OCSP requests to the CA.
- Reduces latency and improves privacy by hiding client browsing patterns from CAs.
- Requires the server to periodically fetch and cache fresh OCSP responses.
- Supported in TLS 1.2 and TLS 1.3; often paired with the Must-Staple extension.
How it works in practice
Related terms
References
More in TLS & PKI
ACME Protocol
ACME (Automated Certificate Management Environment) is a protocol that automates the issuance, renewal, and revocation of TLS certificates, defined in RFC 8555.
Certificate Authority
A Certificate Authority (CA) is a trusted entity that issues digital certificates after verifying that the requester controls the domain or identity named in the certificate.
Certificate Chain
A certificate chain is an ordered list of certificates, starting with the server certificate and ending with a root CA, that a client validates to establish trust in the server's identity.
Certificate Pinning
A security technique where an application trusts only a specific, pre-selected certificate or public key for a given server, bypassing the standard chain of trust.
Cipher Suite
A cipher suite is a named set of cryptographic algorithms negotiated during a TLS handshake, specifying key exchange, authentication, encryption, and integrity protection for secure communications.
Domain Validation
Domain Validation (DV) is the lowest level of certificate validation used in TLS/SSL, where the certificate authority verifies only that the applicant controls the domain name, typically via an HTTP or DNS challenge.
ECH
Encrypted Client Hello (ECH) is a TLS extension that encrypts the Client Hello message, including the Server Name Indication (SNI), to prevent on-path observers from learning the target hostname during the handshake.
Extended Validation
Extended Validation (EV) is the highest level of TLS certificate assurance, requiring the certificate authority to perform rigorous, human-verified checks on the legal identity and operational existence of the requesting organization before issuance.
HSTS
HTTP Strict Transport Security (HSTS) is a web security policy mechanism that forces browsers to interact with a website only over HTTPS, preventing downgrade attacks and cookie hijacking.
Intermediate Certificate
An intermediate certificate is a subordinate CA certificate signed by a root CA, used to sign end-entity certificates and enable path validation while the root remains offline.