What Is OCSP Stapling and How to Enable It

How Browsers Check for Revoked Certificates

A certificate can be revoked before it expires, for example if its private key is compromised. Certificate authorities publish revocation information in two ways:

• CRL (Certificate Revocation List) is a signed list of all revoked certificates that clients download and cache.
• OCSP (Online Certificate Status Protocol) lets a client ask the CA about one specific certificate and get a signed answer: good, revoked, or unknown.

OCSP has two drawbacks. Each check adds a delay while the browser waits for the CA's response, and the CA learns which websites the visitor is opening. OCSP stapling solves both.

Revocation checking is also changing. Since 2024, CRLs are mandatory for publicly trusted CAs and OCSP is optional, and some CAs have stopped offering OCSP altogether. DigiCert and Sectigo still run OCSP services, so stapling works for their certificates. Chrome doesn't use OCSP at all and relies on its own revocation lists, so stapling mainly benefits Firefox and other clients.

How OCSP Stapling Works

1. Your web server asks the CA's OCSP service for the status of its own certificate.
2. The CA returns a signed response with a limited validity, usually a few days.
3. The server caches the response and renews it before it expires.
4. During each TLS handshake, the server attaches ("staples") the cached response. The browser checks the CA's signature on it and doesn't need to contact the CA.

Because the response is signed by the CA, the server can't forge it. For how the handshake works, see SSL/TLS Handshake: How It Works Step by Step .

How to Enable OCSP Stapling

Apache. Add this line to your SSL configuration, outside any <VirtualHost> block:

SSLStaplingCache "shmcb:logs/ssl_stapling(32768)"

Then add this line inside the <VirtualHost *:443> block of each site and restart Apache:

SSLUseStapling On

NGINX. Add these lines to the server block that listens on port 443. The ssl_trusted_certificate file is the CA bundle with your intermediate certificates:

ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /path/to/ca-bundle.crt;
resolver 8.8.8.8 1.1.1.1 valid=300s;

Check the configuration with sudo nginx -t, then reload NGINX.

IIS. OCSP stapling is enabled by default on Windows Server. There's nothing to configure.

How to Check That It Works

Run this command, replacing example.com with your domain:

openssl s_client -connect example.com:443 -servername example.com -status

If stapling works, the output includes OCSP Response Status: successful. If it shows OCSP response: no response sent, stapling isn't active. You can also run an online test such as SSL Labs and look for OCSP stapling: Yes in the results.

Is It Worth Enabling?

OCSP stapling is a small improvement rather than a must-have: it makes connections slightly faster and keeps visitors' browsing private from the CA, and it doesn't affect anything if it fails. If your server supports it, turning it on takes a couple of minutes.

You may also come across OCSP Must-Staple, a certificate option that makes browsers reject the connection if no stapled response is provided. Because OCSP is becoming optional, Must-Staple isn't recommended for new deployments.