OCSP (Online Certificate Status Protocol)
How clients learn whether a TLS certificate has been revoked before trusting it — and how OCSP stapling lets the server prove validity quickly and privately.
What it is
OCSP lets a client ask the issuing CA whether a certificate is still valid. Because a live query is slow and leaks which sites you visit, OCSP stapling has the server fetch a signed, time-stamped status and attach it to the TLS handshake, so the client gets revocation proof with no extra round trip.
Why it matters
- It ensures a compromised, revoked certificate is not silently trusted.
- Stapling improves both handshake speed and user privacy.
Common mistakes
- Not enabling OCSP stapling, adding latency and a privacy leak on every connection.
- Serving a stale or missing staple, so clients fall back to slow live checks.
How WebInspect checks this
- WebInspect reports certificate details including OCSP/stapling and revocation signals.