OCSP Stapling (OCSP Stapling)
The Importance of OCSP Stapling
OCSP stapling solves the three main problems with traditional OCSP: privacy, performance, and reliability. With stapling, the browser never contacts the CA directly, so the CA cannot track which sites users visit. The OCSP response is delivered as part of the TLS handshake, saving a round trip to the CA's servers. And because the server caches the response, temporary CA outages do not affect revocation checking.
The server periodically fetches a fresh OCSP response (typically every few hours) and caches it. The response is signed by the CA, so it cannot be forged by the server. If the certificate has been revoked, the server will receive a "revoked" response and clients that enforce stapling will refuse to connect.
Enabling OCSP stapling is straightforward on most web servers (a few lines of configuration in Nginx or Apache) and provides a measurable performance improvement by reducing the number of external requests during the TLS handshake. It is considered a best practice for all HTTPS servers.
How to Check
An SSL checker reports whether OCSP stapling is enabled on your server. You can also test with the openssl command: openssl s_client -connect yourdomain.com:443 -status. Look for "OCSP Response Status: successful" in the output to confirm stapling is active.