OCSP Stapling and Certificate Transparency

Certificate Revocation Lists (CRLs) are files published by CAs listing all revoked certificates. CRLs suffer from several problems: they grow large over time, clients must download them completely, they have limited freshness (published on a schedule), and browsers historically soft-failed (accepted certificates) when CRL fetching failed, making revocation unreliable in practice.

The Online Certificate Status Protocol (OCSP, RFC 6960) allows clients to query a CA's OCSP responder in real time for the revocation status of a specific certificate. An OCSP response states the certificate is "good," "revoked," or "unknown" and is signed by the CA. This is more efficient than downloading an entire CRL.

Standard OCSP has a significant privacy flaw: the client must contact the CA's OCSP responder with the certificate serial number being checked, which reveals to the CA (or a network observer) which websites the user is visiting and when. This creates a surveillance mechanism that violates user privacy at the certificate authority level.

OCSP stapling (RFC 6066) solves the privacy problem by having the server pre-fetch the OCSP response from the CA and cache it. During the TLS handshake, the server "staples" this cached response to the handshake, delivering it directly to the client. The client gets fresh revocation status without contacting the CA directly.

Nginx OCSP stapling configuration requires: "ssl_stapling on; ssl_stapling_verify on; resolver 8.8.8.8;" in the server block. The ssl_certificate_by_lua_block or the ssl_trusted_certificate directive provides the chain for verification. Apache requires "SSLUseStapling on" in the VirtualHost. Both servers cache the response and refresh it before expiry.

The OCSP Must-Staple X.509 extension (RFC 7633) tells browsers that this certificate's server will always staple an OCSP response. If a browser connects to the server and does not receive a stapled response, it rejects the connection. This prevents an attacker who has revoked-certificate from blocking OCSP responses to force soft-fail behavior.

Certificate Transparency (CT) is a system where all publicly-trusted CAs are required to log every certificate they issue to publicly auditable, append-only logs before the certificate is delivered. These logs allow domain owners, researchers, and monitors to detect misissued or fraudulently obtained certificates for any domain.

When a CA submits a certificate to a CT log, the log returns a Signed Certificate Timestamp (SCT). The SCT is a cryptographically signed promise that the certificate has been logged. SCTs are embedded in the certificate itself, delivered via TLS extension, or stapled in the OCSP response. Chrome requires at least two SCTs for trust.

Google Chrome has required Certificate Transparency for all publicly-trusted TLS certificates since April 2018. Certificates without valid SCTs are rejected by Chrome with a certificate error. This requirement effectively enforces CT logging by all major CAs, since any CA whose certificates are rejected by Chrome cannot operate as a public CA.

CT logs enable anyone to monitor for certificates issued for their domain. Services like crt.sh and Facebook's CT Monitor allow domain owners to search all CT logs for certificates with their domain in the subject or SAN fields. Unauthorized certificate issuance (e.g., by a compromised CA or via BGP hijacking) becomes detectable within hours.

CT logs are operated by multiple independent organizations including Google (Argon, Xenon), Cloudflare (Nimbus), DigiCert, Sectigo, and others. Multiple log operators prevent any single entity from suppressing a logged certificate. Browsers require SCTs from logs on their approved list, maintaining quality control over which logs are trusted.

What problem does OCSP stapling solve compared to standard OCSP?

CRLs are large and stale; OCSP provides real-time revocation but leaks browsing data to CAs. OCSP stapling delivers pre-fetched revocation status during the TLS handshake, preserving privacy. OCSP Must-Staple prevents soft-fail bypass. Certificate Transparency logs all issued certificates, enabling detection of misissued certs via SCTs. Chrome requires CT since 2018.