---
title: "OCSP stapling"
description: "OCSP stapling lets a web server attach a signed proof of a TLS certificate's validity to the handshake. Learn how it speeds pages and protects privacy."
url: "https://nodea.io/en/glossary/ocsp-stapling"
lang: "en"
updated: "2026-07-13"
---

# OCSP stapling

> OCSP stapling is a TLS optimization where the web server fetches and attaches a signed proof of its SSL certificate's validity to the handshake, sparing the browser.

**OCSP stapling** is a [TLS](https://nodea.io/en/glossary/tls) optimization in which the web server takes over the job of checking whether an SSL certificate has been revoked and attaches a ready-made proof of validity directly to the handshake. The name comes from the idea of "stapling" an OCSP response to the certificate, so the browser no longer has to query the certificate authority on its own.

## How OCSP stapling works

An SSL certificate can be revoked before its expiry date, so a browser should verify its status. In the classic OCSP (Online Certificate Status Protocol) model the browser does this itself by contacting the certificate authority's server — which adds latency to page load and reveals to the CA which sites the user is visiting.

With stapling the web server takes the initiative: it periodically fetches a signed, timestamped validity response from the CA, caches it, and attaches it to the handshake of every new [HTTPS](https://nodea.io/en/glossary/https) connection. Because the response is cryptographically signed by the CA, the server cannot forge it, and the browser trusts it exactly as if it had asked the authority directly.

## Practical application

OCSP stapling speeds up the first connection to a site by removing an extra network round trip to the CA, and it improves privacy — the certificate authority no longer sees users' IP addresses or browsing history. It also solves an availability problem: if the CA's OCSP responder is temporarily unreachable, the page still loads correctly from the server's cached response.

The technique is supported out of the box by mainstream servers such as Apache, Nginx and LiteSpeed and works with free [Let's Encrypt](https://nodea.io/en/glossary/lets-encrypt-ssl-certificates) certificates. On a well-configured hosting account or VPS, stapling runs without any user intervention and is one of the small but measurable factors that improve how fast a site loads.

### Do I need to configure OCSP stapling myself?

On shared hosting usually not — control panels and web servers such as Apache, Nginx and LiteSpeed enable stapling by default. On your own VPS you just add a few server directives and point them at your certificate chain file. Verify it afterwards with an SSL test, because a wrong path to the chain is the most common reason stapling silently fails.

## Related

- [SSL](https://nodea.io/en/glossary/ssl)
- [TLS](https://nodea.io/en/glossary/tls)
- [HTTPS](https://nodea.io/en/glossary/https)
- [Let's Encrypt (SSL certificates)](https://nodea.io/en/glossary/lets-encrypt-ssl-certificates)
- [HSTS (HTTP Strict Transport Security)](https://nodea.io/en/glossary/hsts)

---

Languages: [pl](https://nodea.pl/pl/slownik-pojec/ocsp-stapling.md)  
Site index: [llms.txt](https://nodea.io/en/llms.txt)