{"id":3004,"date":"2022-07-18T10:14:00","date_gmt":"2022-07-18T10:14:00","guid":{"rendered":"https:\/\/sectigostore.com\/blog\/?p=3004"},"modified":"2022-05-23T22:20:46","modified_gmt":"2022-05-23T22:20:46","slug":"what-is-ocsp-stapling-why-does-it-matter","status":"publish","type":"post","link":"https:\/\/sectigostore.com\/blog\/what-is-ocsp-stapling-why-does-it-matter\/","title":{"rendered":"What Is OCSP Stapling &#038; Why Does It Matter?"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">OCSP stapling makes verifying the revocation status of an SSL\/TLS certificate faster and easier for a client than ever before. It\u2019s an improvement on the current industry standard, OCSP. But what is OCSP stapling and why does it matter to your website\u2019s security?<\/h2>\n\n\n\n<p>When you use a browser to access a website, the browser checks many things on the site\u2019s TLS certificate: the certificate\u2019s signature, validity period, whether the certificate is valid or revoked, etc. There are several methods for verifying the revocation status of the TLS certificate, including certificate revocation lists (CRLs), the online certificate status protocol (OCSP), and OCSP stapling.<\/p>\n\n\n\n<p>In our previous article, we looked at OCSP and how it helps you verify the revocation status of a website certificate. With OCSP, the client requests the site\u2019s certificate from the site. The site\u2019s web server sends its certificate to the issuing CA, which uses its OCSP responder to provide information about the certificate\u2019s revocation status. In turn, the web server then sends it back to the user\u2019s browser.<\/p>\n\n\n\n<p>It\u2019s a secure method, but it has its limitations. OCSP stapling was developed to overcome some of those limitations.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What Is OCSP Stapling? A Look at the Online Certificate Status Protocol Stapling<\/h2>\n\n\n\n<p>OCSP stapling refers to the verification technique for the status revocation of X.509 certificates, where the server sends periodical status requests to the CA and passes on the CA\u2019s response to the client browser. Thus, when the client browser wants to connect, the server will present the CA&#8217;s status response indicating whether the certificate is valid or revoked.<\/p>\n\n\n\n<p>OCSP stapling is described in <a href=\"https:\/\/datatracker.ietf.org\/doc\/html\/rfc2560\">the RFC 2560<\/a> and <a href=\"https:\/\/datatracker.ietf.org\/doc\/html\/rfc5019\">RFC 5019<\/a>. The website\u2019s server provides an updated status directly to the client attempting to connect. The client can trust it as it is signed and timestamped by the issuing CA.<\/p>\n\n\n\n<p>To help you visualize the process, imagine your doorbell rings at an odd hour. You open the door and see two serious-looking people standing on the doorstep, who ask whether they can come in for a chat. Do you let them in? Probably not. But what if they\u2019re wearing uniforms and have ID badges saying they work for the FBI? Then your perspective might change. Think of OCSP stapling as being akin to those ID badges. You don\u2019t need to check with the FBI when an agent knocks on your door, because the badges indicate that they can be trusted.<\/p>\n\n\n\n<p>As a client connecting to a website, the website shows you a digitally signed, timestamped report detailing whether the TLS certificate is valid. Just like the FBI issues those badges, the verification is issued by the CA. The FBI will take away the badge if an agent is suspended, fired, or quits \u2014 similarly, CAs revoke TLS certificates under certain circumstances.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How OCSP Stapling Differs from CRLs<\/h2>\n\n\n\n<p>OCSP is better than using CRLs to verify the revocation status of TLS certificates. A CRL is the whole list of revoked website certificates that gets periodically updated. OCSP refers to a server response that comes from a website certificate\u2019s issuing CA. It provides current, up-to-date data about the certificate\u2019s revocation status. However, as a result, also uses more resources. OCSP stapling is a third option that keeps information about the certificate\u2019s revocation status readily on hand by \u201cstapling\u201d it.<\/p>\n\n\n\n<p>OCSP process can be slow when lots of clients send requests to high-traffic websites because the certificate authority (CA) must send out individual responses to individual clients. Using OCSP stapling speeds up the process as the website server will have the certificate ready for the client whenever they asked for. So, instead of numerous clients placing individual requests to the CA, the server itself will send requests at regular intervals.&nbsp;<\/p>\n\n\n\n<p>So, the traditional OCSP is more accurate than OCSP stapling because it\u2019s providing a real-time server response (versus something that may have been issued prior to a certificate being revoked). But OCSP stapling is helpful because it helps to improve performance because it can rely on the timestamped information and doesn\u2019t have to make a new revocation check.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How Does OCSP Stapling Work?<\/h2>\n\n\n\n<p>Unlike with other verification methods, where the client takes responsibility for verifying the certificate revocation status of websites, OCSP stapling places the burden on the server. When a client wants to connect, the server presents the last updated verification status to them. &nbsp;The CA has the authority to decide the refreshing time of the response. The client can trust the certificate as it is signed by the CA that issued the server certificate. It\u2019ll also include a timestamp that shows the date and time it was created. &nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">A Step-by-Step Look at OCSP Stapling<\/h3>\n\n\n\n<p>The OCSP stapling process goes like this:<\/p>\n\n\n\n<ol class=\"wp-block-list\" type=\"1\"><li>The web server requests the updated revocation status from the CA on the backend as the two entities are in regular communication.<\/li><li>The CA sends signed, timestamped information about its revocation status to the server, which stores it in its cache.<\/li><li>The client browser sends a connection request to the server.<\/li><li>The server \u201cstaples\u201d or annexes the cached information about its own revocation status to its reply to the client.<\/li><li>If the server certificate is valid, the client browser will connect to the website.<\/li><li>If the server certificate is revoked, the client browser will display an error message that the certificate is invalid.<\/li><\/ol>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"858\" height=\"802\" src=\"https:\/\/sectigostore.com\/blog\/wp-content\/uploads\/2022\/05\/how-ocsp-stapling-works.png\" alt=\"OCSP stapling graphic: A diagram providing a basic overview of how OCSP stapling works\" class=\"wp-image-3006\" srcset=\"https:\/\/sectigostore.com\/blog\/wp-content\/uploads\/2022\/05\/how-ocsp-stapling-works.png 858w, https:\/\/sectigostore.com\/blog\/wp-content\/uploads\/2022\/05\/how-ocsp-stapling-works-300x280.png 300w, https:\/\/sectigostore.com\/blog\/wp-content\/uploads\/2022\/05\/how-ocsp-stapling-works-560x523.png 560w\" sizes=\"auto, (max-width: 858px) 100vw, 858px\" \/><\/figure>\n\n\n\n<p>A visual representation of how OCSP stapling works<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Certificate Responses<\/h3>\n\n\n\n<p>The following responses are possible with OCSP stapling:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>Revoked: <\/strong>When a server certificate is revoked, the browser will show a warning and likely not connect to the website. This response is known as a hard fail because the browser will immediately terminate the connection. A revocation message will look like this to users:<\/li><\/ul>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"655\" src=\"https:\/\/sectigostore.com\/blog\/wp-content\/uploads\/2022\/05\/badssl-certificate-revoked-warning-1024x655.png\" alt=\"OCSP stapling graphic: A screenshot of an error message that populates in the browser for users when a website's certificate gets revoked\" class=\"wp-image-3007\" srcset=\"https:\/\/sectigostore.com\/blog\/wp-content\/uploads\/2022\/05\/badssl-certificate-revoked-warning-1024x655.png 1024w, https:\/\/sectigostore.com\/blog\/wp-content\/uploads\/2022\/05\/badssl-certificate-revoked-warning-300x192.png 300w, https:\/\/sectigostore.com\/blog\/wp-content\/uploads\/2022\/05\/badssl-certificate-revoked-warning-560x358.png 560w, https:\/\/sectigostore.com\/blog\/wp-content\/uploads\/2022\/05\/badssl-certificate-revoked-warning-940x601.png 940w, https:\/\/sectigostore.com\/blog\/wp-content\/uploads\/2022\/05\/badssl-certificate-revoked-warning.png 1067w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Image caption: An example screenshot of a revoked certificate warning message that displays in Google Chrome.<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>Good:<\/strong> A good response is given when the OCSP responder recognizes the certificate serial number and finds that it is valid.<\/li><\/ul>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>Unknown:<\/strong> This message displays if the responder doesn\u2019t recognize the certificate, an unknown response is sent. The responder might not have access to the CA that issued the certificate. This type of failure is called a soft fail because it may (or may not) allow the connection to go through.<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">What Are the Advantages of Enabling OCSP Stapling?<\/h2>\n\n\n\n<p>There are many advantages of using OCSP stapling for verifying the revocation status of TLS certificates, including:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>Offers improved speed and performance. <\/strong>Speed is one of the most significant advantages of the OCSP stapling method. It takes a minimal amount of time to verify the revocation status of any TLS certificate.<\/li><\/ul>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>Providers better privacy for users. <\/strong>Since the CA or the OCSP responder can\u2019t see the websites visited by the client, the client\u2019s privacy is better protected than with traditional OCSP responder queries.<\/li><\/ul>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>Requires fewer resources. <\/strong>In comparison to CRL or OCSP, the OCSP stapling uses fewer network resources for the client, making it a more efficient method.<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">3 Limitations of OCSP Stapling<\/h2>\n\n\n\n<p>As with any other protocol, OCSP stapling has its limitations:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>No verification of intermediate certificates. <\/strong>Sometimes, TLS certificates contain many intermediate CA certificates forming a <a href=\"https:\/\/sectigostore.com\/blog\/what-is-an-ssl-certificate-chain-how-does-it-work\/\">certificate chain<\/a>. OCSP stapling typically doesn\u2019t provide verification for the intermediate certificates (it typically just provides revocation status checks for leaf\/server certificates). However, multi-stapling was introduced in June 2013 through <a href=\"https:\/\/datatracker.ietf.org\/doc\/html\/rfc6961\">RFC 6961<\/a>. <a href=\"https:\/\/www.gnutls.org\/manual\/html_node\/OCSP-stapling.html\">TLS 1.3<\/a> has the support for multiple OCSP responses.<\/li><\/ul>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>Period between OCSP responses may leave you unaware of new revocations. <\/strong>There is usually a delay between two OCSP stapling responses. This time gap can be a few hours or longer. If the certificate is revoked during that time, the server could give out outdated responses.&nbsp;<\/li><\/ul>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>OCSP stapling isn\u2019t supported by all browsers. <\/strong>Not all browsers and web servers support stapling at the current time, although it is becoming more widespread.<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Distinguishing Features of OCSP Stapling Over CRLs &amp; OCSP<\/h2>\n\n\n\n<p>Some of the features that differentiate OCSP stapling from other methods are:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>Liability of Proof: <\/strong>When a server uses OCSP stapling and the website visitor\u2019s client supports it, the server takes on the responsibility of proving that its TLS certificate has not been revoked.<\/li><li><strong>Cost of Proof: <\/strong>The cost of requesting and providing the revocation status is to be borne by the server, including its processing and network-related resources.<\/li><li><strong>Improved Efficiency: <\/strong>The client doesn\u2019t have to request the revocation status of the TLS certificate; the server will provide one automatically from the certificate\u2019s issuing CA. It saves time and makes the TLS handshake very efficient.<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">OCSP vs. OCSP Stapling at a Glance<\/h2>\n\n\n\n<p>OCSP stapling builds on simple OCSP. This table lays out the differences between the two methods:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><tbody><tr><td><strong>OCSP<\/strong><\/td><td><strong>OCSP Stapling<\/strong><\/td><\/tr><tr><td>The responsibility of verification lies with the client browser<\/td><td>The server has to provide proof that the certificate has not been revoked<\/td><\/tr><tr><td>The privacy of the client might be compromised as the CA can see all the websites the user has visited<\/td><td>The server contacts the CA for its timestamped response, so the CA can\u2019t see other sites visited by the client<\/td><\/tr><tr><td>The cost of verification is borne by the client<\/td><td>The cost of verification is borne by the server<\/td><\/tr><tr><td>Slower than OCSP stapling as there are many rounds of communication<\/td><td>Faster than OCSP because it doesn\u2019t have to send out individual OCSP server requests<\/td><\/tr><tr><td>Not ideal for high-traffic websites<\/td><td>Ideal for high-traffic websites<\/td><\/tr><tr><td>All certificates in the certificate chain can be verified<\/td><td>Not all certificates in the certificate can be verified as the server only staples its own revocation status response<\/td><\/tr><tr><td>No time gap between the request from the client browser and the response from the CA<\/td><td>There is an interval between two requests sent by the server to the CA<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">Which Browsers Support It<\/h3>\n\n\n\n<p>OCSP stapling is enabled by default in most of the big browsers, but it\u2019s not universally supported. The following <a href=\"https:\/\/knowledge.digicert.com\/quovadis\/ssl-certificates\/ssl-general-topics\/what-is-ocsp-stapling.html#:~:text=Disadvantages,checking directly with the CA.\">browsers and <\/a>services support this revocation check method:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Apache \u2014 Apache HTTPD Server 2.3.3+<\/li><li>Edge \u2014 Supports it<\/li><li>Firefox \u2014 Firefox enabled default in version 3.0 and above<\/li><li>Google Chrome \u2014 Enabled by default<\/li><li>Internet Explorer \u2014 Version 7.0 and above supports OCSP stapling<\/li><li>NSS (Network Security Services) \u2014 Supported by version 3.15 and above<\/li><li>OpenSSL \u2014 Supported by version 0.9.8h and above<\/li><li>Opera \u2014 Version 8.0 and above supports stapling<\/li><li>Safari \u2014 Enabled by default in Mac OS X 10.7 and above<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">How Can You Turn on OCSP Stapling?<\/h2>\n\n\n\n<p>Most browsers have OCSP stapling enabled by default. However, if you want to enable it for your server, you can do so. Below, we\u2019ve outlined the steps for enabling this revocation checking method in Apache specifically.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Enabling OCSP Stapling in Apache<\/h3>\n\n\n\n<p>If you use Apache, then you can follow the steps given below to <a href=\"https:\/\/sectigo.com\/knowledge-base\/detail\/Enable-OCSP-Stapling-on-Apache-1527076084671\/kA01N000000zFJl\">enable OCSP stapling<\/a>:<\/p>\n\n\n\n<ol class=\"wp-block-list\" type=\"1\"><li>Check which version of Apache you use. The versions Apache 2.3.3+ allow this revocation check method. You can verify which environment you\u2019re using with one of the two following commands (the first is for Ubuntu or Debian, the second is for CentOs or Red Hat):<\/li><\/ol>\n\n\n\n<pre class=\"wp-block-code\"><code>apache2 -v \n\nhttpd -v<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\"><li>Before you turn on OCSP stapling on the Apache server, you first need to confirm that your <a href=\"https:\/\/kb.wisc.edu\/sslservercerts\/page.php?id=18923\">intermediate certificates<\/a> are installed properly.<\/li><\/ul>\n\n\n\n<ul class=\"wp-block-list\"><li>You\u2019ll also want to make sure you don\u2019t already have OCSP stapling enabled. To do this, use the following OpenSSL command (you should see an OCSP response message \u201cSuccessful\u201d):<\/li><\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>openssl s_client -connect yourdomain.com:443 -status<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\"><li>Now, it\u2019s time to edit your site\u2019s virtual host configuration file using an editor like Nano or Vi:<\/li><\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>nano \/filepath\/apache2\/ssl\/your-domain-ssl.conf<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\"><li>Now, it\u2019s time to turn on OCSP. You can do this with the following command inside the virtual host tags (they look like <em>&lt;VirtualHost&gt;&lt;\/VirtualHost&gt;<\/em>):<\/li><\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>SSLUseStapling on<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\"><li>You can specify the time (in seconds) to wait for the OCSP response from the responder. For example, here\u2019s how to set it for 15 seconds:<\/li><\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>SSLStaplingResponder Timeout 15<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\"><li>Prevent the error message by entering the following command:<\/li><\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>SSLStaplingReturnResponderErrors off<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\"><li>Point to the path of your full trusted certificate chain, including root, intermediate, and server by placing the following command inside the &lt;VirtualHost&gt;&lt;\/VisualHost&gt; tags:<\/li><\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>SSLCACertificateFile \/yourpath\/apache2\/ssl\/full_cert_chain.pem<\/code><\/pre>\n\n\n\n<p>Otherwise, you can specifically link to your certificate and key files:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>SSLCertificateFile \/yourpath\/apache2\/ssl\/yourdomain_certificate.crt\nSSLCertificateKeyFile \/yourpath\/apache2\/ssl\/yourdomain.com\/example_key.key<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\"><li>Use the following command (outside the VirtualHost tags) to specify the place where you want to cache the OCSP response:<\/li><\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>SSLStaplingCache shmcb:\/var\/run\/ocsp(128000)<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Test Your Configurations and Reload Apache<\/h3>\n\n\n\n<p>Of course, once all of this is done, you\u2019ll need to double-check to ensure that everything is properly configured. You can do this by running a quick test and reloading your Apache service using the following commands:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>apachectl -t\nservice apache2 reload<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Final Thoughts on OCSP Stapling and Why It Matters<\/h2>\n\n\n\n<p>Visiting sites with expired or revoked TLS certificates can easily lead to cybercriminals stealing your customers\u2019 critical sensitive data so they can use it for malicious purposes. OCSP stapling is a technique that allows browsers to verify whether the TLS certificate of a website you want to visit has been revoked by providing a real-time revocation status check.<\/p>\n\n\n\n<p>Although OCSP stapling is faster and more efficient than CRLs and OCSP, it\u2019s not universally supported by all browsers. However, it is gaining in popularity, though, and you may see it utilized more in the future.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>OCSP stapling makes verifying the revocation status of an SSL\/TLS certificate faster and easier for a client than ever before. It\u2019s an improvement on the current industry standard, OCSP. But&#8230;<\/p>\n","protected":false},"author":19,"featured_media":3010,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":"","tve_updated_post":"","tve_custom_css":"","tve_user_custom_css":"","tve_globals":{},"tcb2_ready":0,"tcb_editor_enabled":0,"tve_landing_page":"","_tve_header":"","_tve_footer":""},"categories":[13],"tags":[260],"class_list":["post-3004","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cyber-security","tag-ocsp-stapling","post-with-tags"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.6 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>What Is OCSP Stapling &amp; Why Does It Matter? - InfoSec Insights<\/title>\n<meta name=\"description\" content=\"OCSP stapling is a tactic admins can use to attach a website&#039;s latest certificate revocation status report to it. Here&#039;s what it is &amp; how it works.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/sectigostore.com\/blog\/what-is-ocsp-stapling-why-does-it-matter\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"What Is OCSP Stapling &amp; Why Does It Matter? - InfoSec Insights\" \/>\n<meta property=\"og:description\" content=\"OCSP stapling is a tactic admins can use to attach a website&#039;s latest certificate revocation status report to it. Here&#039;s what it is &amp; how it works.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/sectigostore.com\/blog\/what-is-ocsp-stapling-why-does-it-matter\/\" \/>\n<meta property=\"og:site_name\" content=\"InfoSec Insights\" \/>\n<meta property=\"article:published_time\" content=\"2022-07-18T10:14:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/sectigostore.com\/blog\/wp-content\/uploads\/2022\/05\/ocsp-stapling-feature-ocsp-response.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1600\" \/>\n\t<meta property=\"og:image:height\" content=\"1000\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Megha Thakkar\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Megha Thakkar\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"10 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/what-is-ocsp-stapling-why-does-it-matter\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/what-is-ocsp-stapling-why-does-it-matter\\\/\"},\"author\":{\"name\":\"Megha Thakkar\",\"@id\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/#\\\/schema\\\/person\\\/77f01ec498571464bae513fa5bfd42da\"},\"headline\":\"What Is OCSP Stapling &#038; Why Does It Matter?\",\"datePublished\":\"2022-07-18T10:14:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/what-is-ocsp-stapling-why-does-it-matter\\\/\"},\"wordCount\":2189,\"image\":{\"@id\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/what-is-ocsp-stapling-why-does-it-matter\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/wp-content\\\/uploads\\\/2022\\\/05\\\/ocsp-stapling-feature-ocsp-response.jpg\",\"keywords\":[\"OCSP Stapling\"],\"articleSection\":[\"Cyber Security\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/what-is-ocsp-stapling-why-does-it-matter\\\/\",\"url\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/what-is-ocsp-stapling-why-does-it-matter\\\/\",\"name\":\"What Is OCSP Stapling & Why Does It Matter? - InfoSec Insights\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/what-is-ocsp-stapling-why-does-it-matter\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/what-is-ocsp-stapling-why-does-it-matter\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/wp-content\\\/uploads\\\/2022\\\/05\\\/ocsp-stapling-feature-ocsp-response.jpg\",\"datePublished\":\"2022-07-18T10:14:00+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/#\\\/schema\\\/person\\\/77f01ec498571464bae513fa5bfd42da\"},\"description\":\"OCSP stapling is a tactic admins can use to attach a website's latest certificate revocation status report to it. Here's what it is & how it works.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/what-is-ocsp-stapling-why-does-it-matter\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/sectigostore.com\\\/blog\\\/what-is-ocsp-stapling-why-does-it-matter\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/what-is-ocsp-stapling-why-does-it-matter\\\/#primaryimage\",\"url\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/wp-content\\\/uploads\\\/2022\\\/05\\\/ocsp-stapling-feature-ocsp-response.jpg\",\"contentUrl\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/wp-content\\\/uploads\\\/2022\\\/05\\\/ocsp-stapling-feature-ocsp-response.jpg\",\"width\":1600,\"height\":1000,\"caption\":\"OCSP stapling feature image -- a screenshot of an OCSP server check method in OpenSSL\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/what-is-ocsp-stapling-why-does-it-matter\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"What Is OCSP Stapling &#038; Why Does It Matter?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/\",\"name\":\"InfoSec Insights\",\"description\":\"SectigoStore.com Blog\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/#\\\/schema\\\/person\\\/77f01ec498571464bae513fa5bfd42da\",\"name\":\"Megha Thakkar\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/390ac6e8c0915150ea845acfc11db159571a2dc74d5745edc8edacec9f996bce?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/390ac6e8c0915150ea845acfc11db159571a2dc74d5745edc8edacec9f996bce?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/390ac6e8c0915150ea845acfc11db159571a2dc74d5745edc8edacec9f996bce?s=96&d=mm&r=g\",\"caption\":\"Megha Thakkar\"},\"description\":\"Megha can usually be found reading, writing, or watching documentaries, guaranteed to bore her family. She is a techno-freak with interests ranging from cooking to travel. A regular contributor to various web security blogs, she has earned her diploma in network-centric computing. Being a mother has taught her to speak less and write more (coz who listens to moms, right?).\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"What Is OCSP Stapling & Why Does It Matter? - InfoSec Insights","description":"OCSP stapling is a tactic admins can use to attach a website's latest certificate revocation status report to it. Here's what it is & how it works.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/sectigostore.com\/blog\/what-is-ocsp-stapling-why-does-it-matter\/","og_locale":"en_US","og_type":"article","og_title":"What Is OCSP Stapling & Why Does It Matter? - InfoSec Insights","og_description":"OCSP stapling is a tactic admins can use to attach a website's latest certificate revocation status report to it. Here's what it is & how it works.","og_url":"https:\/\/sectigostore.com\/blog\/what-is-ocsp-stapling-why-does-it-matter\/","og_site_name":"InfoSec Insights","article_published_time":"2022-07-18T10:14:00+00:00","og_image":[{"width":1600,"height":1000,"url":"https:\/\/sectigostore.com\/blog\/wp-content\/uploads\/2022\/05\/ocsp-stapling-feature-ocsp-response.jpg","type":"image\/jpeg"}],"author":"Megha Thakkar","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Megha Thakkar","Est. reading time":"10 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/sectigostore.com\/blog\/what-is-ocsp-stapling-why-does-it-matter\/#article","isPartOf":{"@id":"https:\/\/sectigostore.com\/blog\/what-is-ocsp-stapling-why-does-it-matter\/"},"author":{"name":"Megha Thakkar","@id":"https:\/\/sectigostore.com\/blog\/#\/schema\/person\/77f01ec498571464bae513fa5bfd42da"},"headline":"What Is OCSP Stapling &#038; Why Does It Matter?","datePublished":"2022-07-18T10:14:00+00:00","mainEntityOfPage":{"@id":"https:\/\/sectigostore.com\/blog\/what-is-ocsp-stapling-why-does-it-matter\/"},"wordCount":2189,"image":{"@id":"https:\/\/sectigostore.com\/blog\/what-is-ocsp-stapling-why-does-it-matter\/#primaryimage"},"thumbnailUrl":"https:\/\/sectigostore.com\/blog\/wp-content\/uploads\/2022\/05\/ocsp-stapling-feature-ocsp-response.jpg","keywords":["OCSP Stapling"],"articleSection":["Cyber Security"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/sectigostore.com\/blog\/what-is-ocsp-stapling-why-does-it-matter\/","url":"https:\/\/sectigostore.com\/blog\/what-is-ocsp-stapling-why-does-it-matter\/","name":"What Is OCSP Stapling & Why Does It Matter? - InfoSec Insights","isPartOf":{"@id":"https:\/\/sectigostore.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/sectigostore.com\/blog\/what-is-ocsp-stapling-why-does-it-matter\/#primaryimage"},"image":{"@id":"https:\/\/sectigostore.com\/blog\/what-is-ocsp-stapling-why-does-it-matter\/#primaryimage"},"thumbnailUrl":"https:\/\/sectigostore.com\/blog\/wp-content\/uploads\/2022\/05\/ocsp-stapling-feature-ocsp-response.jpg","datePublished":"2022-07-18T10:14:00+00:00","author":{"@id":"https:\/\/sectigostore.com\/blog\/#\/schema\/person\/77f01ec498571464bae513fa5bfd42da"},"description":"OCSP stapling is a tactic admins can use to attach a website's latest certificate revocation status report to it. Here's what it is & how it works.","breadcrumb":{"@id":"https:\/\/sectigostore.com\/blog\/what-is-ocsp-stapling-why-does-it-matter\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/sectigostore.com\/blog\/what-is-ocsp-stapling-why-does-it-matter\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/sectigostore.com\/blog\/what-is-ocsp-stapling-why-does-it-matter\/#primaryimage","url":"https:\/\/sectigostore.com\/blog\/wp-content\/uploads\/2022\/05\/ocsp-stapling-feature-ocsp-response.jpg","contentUrl":"https:\/\/sectigostore.com\/blog\/wp-content\/uploads\/2022\/05\/ocsp-stapling-feature-ocsp-response.jpg","width":1600,"height":1000,"caption":"OCSP stapling feature image -- a screenshot of an OCSP server check method in OpenSSL"},{"@type":"BreadcrumbList","@id":"https:\/\/sectigostore.com\/blog\/what-is-ocsp-stapling-why-does-it-matter\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/sectigostore.com\/blog\/"},{"@type":"ListItem","position":2,"name":"What Is OCSP Stapling &#038; Why Does It Matter?"}]},{"@type":"WebSite","@id":"https:\/\/sectigostore.com\/blog\/#website","url":"https:\/\/sectigostore.com\/blog\/","name":"InfoSec Insights","description":"SectigoStore.com Blog","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/sectigostore.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/sectigostore.com\/blog\/#\/schema\/person\/77f01ec498571464bae513fa5bfd42da","name":"Megha Thakkar","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/390ac6e8c0915150ea845acfc11db159571a2dc74d5745edc8edacec9f996bce?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/390ac6e8c0915150ea845acfc11db159571a2dc74d5745edc8edacec9f996bce?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/390ac6e8c0915150ea845acfc11db159571a2dc74d5745edc8edacec9f996bce?s=96&d=mm&r=g","caption":"Megha Thakkar"},"description":"Megha can usually be found reading, writing, or watching documentaries, guaranteed to bore her family. She is a techno-freak with interests ranging from cooking to travel. A regular contributor to various web security blogs, she has earned her diploma in network-centric computing. Being a mother has taught her to speak less and write more (coz who listens to moms, right?)."}]}},"_links":{"self":[{"href":"https:\/\/sectigostore.com\/blog\/wp-json\/wp\/v2\/posts\/3004","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sectigostore.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sectigostore.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sectigostore.com\/blog\/wp-json\/wp\/v2\/users\/19"}],"replies":[{"embeddable":true,"href":"https:\/\/sectigostore.com\/blog\/wp-json\/wp\/v2\/comments?post=3004"}],"version-history":[{"count":0,"href":"https:\/\/sectigostore.com\/blog\/wp-json\/wp\/v2\/posts\/3004\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/sectigostore.com\/blog\/wp-json\/wp\/v2\/media\/3010"}],"wp:attachment":[{"href":"https:\/\/sectigostore.com\/blog\/wp-json\/wp\/v2\/media?parent=3004"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sectigostore.com\/blog\/wp-json\/wp\/v2\/categories?post=3004"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sectigostore.com\/blog\/wp-json\/wp\/v2\/tags?post=3004"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}