{"id":340,"date":"2019-07-11T13:38:29","date_gmt":"2019-07-11T13:38:29","guid":{"rendered":"https:\/\/cheapsslsecurity.com\/p\/?p=340"},"modified":"2025-03-19T20:53:51","modified_gmt":"2025-03-19T20:53:51","slug":"what-is-ocsp-stapling","status":"publish","type":"post","link":"https:\/\/cheapsslsecurity.com\/p\/what-is-ocsp-stapling\/","title":{"rendered":"What is OCSP Stapling?"},"content":{"rendered":"

OCSP stapling is a mechanism for checking the validity of SSL\/TLS certificates<\/a> \u2014 it\u2019s also an acronym that is amongst the easiest to mix up in tech. Seriously, at some point in this explanation, you\u2019ll likely see OCSP or some jumbled attempt at OCSP stapling, and for this I apologize and blame it on acronym-induced dyslexia. (A quick aside: Giving a group of people a name for their disorder that their disorder will make even more difficult to spell seems exceedingly cruel. I\u2019ve never asked a dyslexic person to spell dyslexia, but I can\u2019t imagine it going well if I did.)<\/p>\n

<\/p>\n

Anyway, Back to Certificate Validity and OCSP Stapling.<\/h2>\n

Generally, when stapling is not employed, one of the calls the client has to make when it\u2019s authenticating a website\u2019s SSL certificate is to the issuing CA\u2019s servers. But what is OCSP? OCSP stands for Online Certificate Status Protocol. It\u2019s useful, but it\u2019s also an extra call that needs to be made, which slows how quickly the website loads and is slightly more taxing on the client.<\/p>\n

When you practice OCSP stapling<\/a>, the server hosting the website and the SSL certificate downloads a copy of the issuing CA\u2019s OCSP response and issues it directly to the client. This saves time and improves performance.<\/p>\n

How OCSP Stapling Works<\/h2>\n

Now that you know the answer to your question \u201cwhat is OCSP?\u201d we can tell you about how OSCP stapling works. Let\u2019s break it down:<\/p>\n

    \n
  1. The web server hosting the SSL certificate sends a query to the issuing CA\u2019s server.<\/li>\n
  2. The issuing CA\u2019s server responds with the OCSP status and a timestamp.<\/li>\n
  3. From this point, whenever a client connects the server staples the OCSP response to the certificate when it\u2019s presented during the handshake.<\/li>\n
  4. The client verifies the signature on the timestamp to ensure it came from the issuing CA.<\/li>\n<\/ol>\n

    Provided everything checks out, the connection continues unabated. If there\u2019s an issue, the client\u2019s browser issues an error message.<\/p>\n

    Benefits of OCSP Stapling<\/h2>\n

    The biggest benefit of OCSP is simply performance. Speed. The handshake is a process that can add a lot of latency to connections. A lot has been done over the years to reduce the handshake<\/a> \u2014 TLS 1.3 has it down to a single roundtrip \u2014 but there\u2019s only so much that can be done to shrink the authentication portion of the process. That\u2019s governed by the baseline requirements and is considered sacrosanct.<\/p>\n

    But OCSP stapling can<\/em> help speed up the authentication process by reducing the number of queries the client has to make when checking validity.<\/p>\n

    That makes pages load quicker and customers happier. Especially at the enterprise level, at scale, this can be a huge performance boost.<\/p>\n

    How Do I Start OCSP Stapling?<\/h2>\n

    The good news is OCSP stapling is enabled by default on IIS servers. It\u2019s also supported by most browsers and servers, even if it requires some extra configuration.<\/p>\n

    For instance, on Apache, you need to add an SSLStaplingCache directive to define where the responses will be stored. Your server\u2019s manufacturer should have documentation on enabling OCSP stapling.<\/p>\n

    And you should find it. And then do that.<\/p>\n

    You\u2019ll be happy you did.<\/p>\n","protected":false},"excerpt":{"rendered":"

    OCSP stapling is a mechanism for checking the validity of SSL\/TLS certificates \u2014 it\u2019s also an acronym that is amongst the easiest to mix up in tech. Seriously, at some point in this explanation, you\u2019ll likely see OCSP or some … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[21],"tags":[10,11],"class_list":["post-340","post","type-post","status-publish","format-standard","hentry","category-ssl-advanced","tag-ocsp","tag-ocsp-stapling"],"yoast_head":"\nWhat is OCSP Stapling? All You Need to Know About SSL Validation<\/title>\n<meta name=\"description\" content=\"Here's what to know about online certificate status protocol stapling, or OCSP stapling \u2014 a mechanism for checking the validity of SSL\/TLS certificates.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cheapsslsecurity.com\/p\/what-is-ocsp-stapling\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"What is OCSP Stapling? All You Need to Know About SSL Validation\" \/>\n<meta property=\"og:description\" content=\"Here's what to know about online certificate status protocol stapling, or OCSP stapling \u2014 a mechanism for checking the validity of SSL\/TLS certificates.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cheapsslsecurity.com\/p\/what-is-ocsp-stapling\/\" \/>\n<meta property=\"og:site_name\" content=\"Cheap SSL Security\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/CheapSSLSecurities\" \/>\n<meta property=\"article:published_time\" content=\"2019-07-11T13:38:29+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-03-19T20:53:51+00:00\" \/>\n<meta name=\"author\" content=\"casey.crane\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@sslsecurity\" \/>\n<meta name=\"twitter:site\" content=\"@sslsecurity\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"casey.crane\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/cheapsslsecurity.com\\\/p\\\/what-is-ocsp-stapling\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/cheapsslsecurity.com\\\/p\\\/what-is-ocsp-stapling\\\/\"},\"author\":{\"name\":\"casey.crane\",\"@id\":\"https:\\\/\\\/cheapsslsecurity.com\\\/p\\\/#\\\/schema\\\/person\\\/d9c1744bb0931c1942814061a5aca108\"},\"headline\":\"What is OCSP Stapling?\",\"datePublished\":\"2019-07-11T13:38:29+00:00\",\"dateModified\":\"2025-03-19T20:53:51+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/cheapsslsecurity.com\\\/p\\\/what-is-ocsp-stapling\\\/\"},\"wordCount\":547,\"keywords\":[\"OCSP\",\"OCSP stapling\"],\"articleSection\":[\"SSL Advanced\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/cheapsslsecurity.com\\\/p\\\/what-is-ocsp-stapling\\\/\",\"url\":\"https:\\\/\\\/cheapsslsecurity.com\\\/p\\\/what-is-ocsp-stapling\\\/\",\"name\":\"What is OCSP Stapling? All You Need to Know About SSL Validation\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/cheapsslsecurity.com\\\/p\\\/#website\"},\"datePublished\":\"2019-07-11T13:38:29+00:00\",\"dateModified\":\"2025-03-19T20:53:51+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/cheapsslsecurity.com\\\/p\\\/#\\\/schema\\\/person\\\/d9c1744bb0931c1942814061a5aca108\"},\"description\":\"Here's what to know about online certificate status protocol stapling, or OCSP stapling \u2014 a mechanism for checking the validity of SSL\\\/TLS certificates.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/cheapsslsecurity.com\\\/p\\\/what-is-ocsp-stapling\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/cheapsslsecurity.com\\\/p\\\/what-is-ocsp-stapling\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/cheapsslsecurity.com\\\/p\\\/what-is-ocsp-stapling\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"SSL Help\",\"item\":\"https:\\\/\\\/cheapsslsecurity.com\\\/p\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"SSL Advanced\",\"item\":\"https:\\\/\\\/cheapsslsecurity.com\\\/p\\\/ssl-advanced\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"What is OCSP Stapling?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/cheapsslsecurity.com\\\/p\\\/#website\",\"url\":\"https:\\\/\\\/cheapsslsecurity.com\\\/p\\\/\",\"name\":\"Cheap SSL Security\",\"description\":\"Shop for SSL Certificates at Cheap Prices\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/cheapsslsecurity.com\\\/p\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/cheapsslsecurity.com\\\/p\\\/#\\\/schema\\\/person\\\/d9c1744bb0931c1942814061a5aca108\",\"name\":\"casey.crane\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/c18d819d34a1995e91a4aa7518e9048df7856f336a1ede2262a572db7b1c2506?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/c18d819d34a1995e91a4aa7518e9048df7856f336a1ede2262a572db7b1c2506?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/c18d819d34a1995e91a4aa7518e9048df7856f336a1ede2262a572db7b1c2506?s=96&d=mm&r=g\",\"caption\":\"casey.crane\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"What is OCSP Stapling? All You Need to Know About SSL Validation","description":"Here's what to know about online certificate status protocol stapling, or OCSP stapling \u2014 a mechanism for checking the validity of SSL\/TLS certificates.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cheapsslsecurity.com\/p\/what-is-ocsp-stapling\/","og_locale":"en_US","og_type":"article","og_title":"What is OCSP Stapling? All You Need to Know About SSL Validation","og_description":"Here's what to know about online certificate status protocol stapling, or OCSP stapling \u2014 a mechanism for checking the validity of SSL\/TLS certificates.","og_url":"https:\/\/cheapsslsecurity.com\/p\/what-is-ocsp-stapling\/","og_site_name":"Cheap SSL Security","article_publisher":"https:\/\/www.facebook.com\/CheapSSLSecurities","article_published_time":"2019-07-11T13:38:29+00:00","article_modified_time":"2025-03-19T20:53:51+00:00","author":"casey.crane","twitter_card":"summary_large_image","twitter_creator":"@sslsecurity","twitter_site":"@sslsecurity","twitter_misc":{"Written by":"casey.crane","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/cheapsslsecurity.com\/p\/what-is-ocsp-stapling\/#article","isPartOf":{"@id":"https:\/\/cheapsslsecurity.com\/p\/what-is-ocsp-stapling\/"},"author":{"name":"casey.crane","@id":"https:\/\/cheapsslsecurity.com\/p\/#\/schema\/person\/d9c1744bb0931c1942814061a5aca108"},"headline":"What is OCSP Stapling?","datePublished":"2019-07-11T13:38:29+00:00","dateModified":"2025-03-19T20:53:51+00:00","mainEntityOfPage":{"@id":"https:\/\/cheapsslsecurity.com\/p\/what-is-ocsp-stapling\/"},"wordCount":547,"keywords":["OCSP","OCSP stapling"],"articleSection":["SSL Advanced"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/cheapsslsecurity.com\/p\/what-is-ocsp-stapling\/","url":"https:\/\/cheapsslsecurity.com\/p\/what-is-ocsp-stapling\/","name":"What is OCSP Stapling? All You Need to Know About SSL Validation","isPartOf":{"@id":"https:\/\/cheapsslsecurity.com\/p\/#website"},"datePublished":"2019-07-11T13:38:29+00:00","dateModified":"2025-03-19T20:53:51+00:00","author":{"@id":"https:\/\/cheapsslsecurity.com\/p\/#\/schema\/person\/d9c1744bb0931c1942814061a5aca108"},"description":"Here's what to know about online certificate status protocol stapling, or OCSP stapling \u2014 a mechanism for checking the validity of SSL\/TLS certificates.","breadcrumb":{"@id":"https:\/\/cheapsslsecurity.com\/p\/what-is-ocsp-stapling\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cheapsslsecurity.com\/p\/what-is-ocsp-stapling\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/cheapsslsecurity.com\/p\/what-is-ocsp-stapling\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"SSL Help","item":"https:\/\/cheapsslsecurity.com\/p\/"},{"@type":"ListItem","position":2,"name":"SSL Advanced","item":"https:\/\/cheapsslsecurity.com\/p\/ssl-advanced\/"},{"@type":"ListItem","position":3,"name":"What is OCSP Stapling?"}]},{"@type":"WebSite","@id":"https:\/\/cheapsslsecurity.com\/p\/#website","url":"https:\/\/cheapsslsecurity.com\/p\/","name":"Cheap SSL Security","description":"Shop for SSL Certificates at Cheap Prices","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/cheapsslsecurity.com\/p\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/cheapsslsecurity.com\/p\/#\/schema\/person\/d9c1744bb0931c1942814061a5aca108","name":"casey.crane","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/c18d819d34a1995e91a4aa7518e9048df7856f336a1ede2262a572db7b1c2506?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/c18d819d34a1995e91a4aa7518e9048df7856f336a1ede2262a572db7b1c2506?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/c18d819d34a1995e91a4aa7518e9048df7856f336a1ede2262a572db7b1c2506?s=96&d=mm&r=g","caption":"casey.crane"}}]}},"_links":{"self":[{"href":"https:\/\/cheapsslsecurity.com\/p\/wp-json\/wp\/v2\/posts\/340","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cheapsslsecurity.com\/p\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cheapsslsecurity.com\/p\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cheapsslsecurity.com\/p\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/cheapsslsecurity.com\/p\/wp-json\/wp\/v2\/comments?post=340"}],"version-history":[{"count":0,"href":"https:\/\/cheapsslsecurity.com\/p\/wp-json\/wp\/v2\/posts\/340\/revisions"}],"wp:attachment":[{"href":"https:\/\/cheapsslsecurity.com\/p\/wp-json\/wp\/v2\/media?parent=340"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cheapsslsecurity.com\/p\/wp-json\/wp\/v2\/categories?post=340"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cheapsslsecurity.com\/p\/wp-json\/wp\/v2\/tags?post=340"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}