OCSP stapling

OCSP stapling is when your web server fetches a certificate revocation answer from the CA and includes it in the TLS handshake. Clients then learn whether the certificate is still valid without contacting the CA themselves, which also avoids leaking the site name to that CA. LiteSpeed on our shared and VPS platforms can perform this stapling for you when outbound access to the CA works.

What usually causes a stall

A stall often means the server cannot reach the CA’s OCSP URL on the outbound path. Firewalls that allow inbound HTTPS but block outbound traffic to the CA are a common cause. When stapling fails, some clients try OCSP on their own, wait for a timeout, and then give up on the connection. Random TLS slowness that is not CPU load and not a cache miss is worth checking as outbound access on ports 80 and 443 from the server. Do not disable SSL as a workaround for a stall of this kind.

Must-staple is a stronger promise

Must-staple is different from ordinary stapling. The certificate itself declares that a staple will always be present. If stapling then fails, clients that honor must-staple will refuse the connection entirely. Leave must-staple off until stapling has worked reliably on that vhost for a while. AutoSSL domain-validated certificates from Let’s Encrypt do not require you to enable that flag yourself.

Shared hosting, VPS, and how to read scan results

On shared hosting you generally do not toggle OCSP stapling per account. On a VPS you control, confirm that LiteSpeed or your TLS terminator can reach the CA outbound, then leave stapling enabled. If a security scan complains about OCSP, read whether it reports “not stapled,” which is often cosmetic, or “must-staple failed,” which is an outage. Those are not the same problem as an expired certificate you forgot to renew.

When you test, inspect the handshake rather than relying on a blog post alone. If LiteSpeed logs show OCSP fetch failures, allow the server outbound access to the CA. An empty staple on an otherwise healthy site is usually cosmetic. A must-staple failure is a real outage, so treat those as different tickets and avoid chasing cipher order because OCSP was slow once overnight.

OCSP checks on the client side are fading in some browsers, yet stapling remains useful while clients still verify, and it is inexpensive when it works. It is not a substitute for a correct chain or a current leaf certificate. An expired certificate with a perfect staple is still expired.