Skip to content
uencoder

OCSP Stapling

OCSP stapling (RFC 6066) lets a server attach a pre-fetched OCSP response during the TLS handshake, sparing the client a separate query.

Purpose

It removes the client's OCSP round trip and its dependency on responder availability, speeding up the handshake and improving privacy.

Mechanism

The server periodically fetches and caches the OCSP response for its own certificate, stapling it after the Certificate message during the TLS handshake. The client verifies the signature and freshness.

Use cases

  • Faster TLS handshakes
  • OCSP privacy
  • CDN certificate validation

Related tools

References