OCSP stapling
OCSP stapling is a way of proving a TLS certificate hasn't been revoked without the connecting client having to contact the certificate authority itself. Normally, checking revocation with the Online Certificate Status Protocol (OCSP) means the client makes a separate request to the certificate authority's responder every time it validates a certificate, which adds latency, leaks which sites a client visits to that authority, and fails unpredictably when the responder is slow or unreachable. With stapling, the server itself periodically fetches a signed, time-stamped OCSP response and attaches ("staples") it directly to the TLS handshake, so the client can verify revocation status from data the server already provided, with no extra round trip or third-party query. It requires server-side support and periodic refreshing of the staple, since a stale one is treated as if no stapling happened at all.
By AdminKit team, Netbase JSC · Updated