We know you\u2019re here to learn what OCSP SSL\/TLS Stapling is and how it works, but we often like to begin our articles with questions. Don\u2019t worry, we\u2019re going to cover OCSP stapling in the simplest way we can. Now, let\u2019s come back to the question. Have you ever seen or heard about an SSL certificate authority revoking an SSL certificate<\/a>? Whether the answer to this question is \u201cyes\u201d or \u201cno,\u201d you need to understand the \u201cwhy\u201d behind the term \u201ccertificate revocation.\u201d<\/p>\n\n\n\n As far as the meaning is concerned, \u201ccertificate revocation\u201d is exactly what it sounds like. It\u2019s a process conducted by the certificate authority to invalidate an issued SSL certificate they issued themselves. Therefore, the certificate is no longer in use and doesn\u2019t protect the information being transmitted between the web server and web browser. As it\u2019s no longer valid, users are notified about the certificate revocation to make them aware of the lack of security.<\/p>\n\n\n\n So, why would a CA revoke a certificate that was issued by it in the first place? Well, there could be two primary reasons behind this. Most often it happens when the person\/organization that issued the certificate, submits a revocation request to the CA. And another possible, but less probable, reason is if the CA has mis-issued the certificate. In both the cases, certificate revocation becomes necessary as it leaves a big security hole that could be exploited very easily.<\/p>\n\n\n\n One thing to note here is that just revoking an SSL certificate isn\u2019t enough, it must be communicated to the end user to make them aware of the status so that they make an informed decision. That\u2019s where OCSP stapling comes into play.<\/p>\n\n\n\n Online Certificate Status Protocol (OCSP) stapling, also known as the TLS Certificate Status Request extension, is an internet standard that allows to check the validity status of X.509 digital certificates. OCSP stapling allows a web server to obtain a digitally signed and time-stamped OCSP response from the OCSP responder operated by the CA that issued the server certificate. The OCSP responder gives a \u2018valid\u2019 or \u2018revoked\u2019 status to the web browser, communicating to the browser about the validity status of the SSL certificate. If the web browser receives a \u201crevoked\u201d message, then it gives a warning to the users so that they don\u2019t exchange confidential information with that website.<\/p>\n\n\n\n A great thing about the OCSP stapling technology is that rather than becoming a completely different process, it becomes a part of standard SSL\/TLS handshake<\/a> that\u2019s used to authenticate, encrypt and transmit the data between the web browser and web server.<\/p>\n\n\n\n 1. When both parties (the browser and the server) come in contact, the web server responds by sharing the SSL certificate installed on it.<\/p>\n\n\n\n 2. Upon receiving the SSL certificate details, the browser requests the server to submit the copy of the response given by the OCSP responder.<\/p>\n\n\n\n 3. In response, the web server gives the copy of the OCSP response.<\/p>\n\n\n\n 4. The browser checks this response and displays the website only if the certificate is valid. The browser will give a warning instead if the certificate has been revoked.<\/p>\n\n\n\n Simple, isn\u2019t it?<\/p>\n\n\n\n You may or may not be aware that OCSP stapling was introduced as an alternative to a technique called \u201cCRL\u201d (certificate revocation list). In CRL, a certificate authority was supposed to maintain a list of all the certificates it has revoked and the browsers were supposed to visit these lists and know whether the certificate of the web server they\u2019re currently communicating with is valid or not. Just by the sound of it, this must be such a boring and dull process, right?Well, it is. That\u2019s because every time the browser has to perform a check, it slows down the performance.<\/p>\n\n\n\n OCSP, on the other hand, doesn\u2019t take a toll on the performance as the webserver (not a web browser) is supposed to download a copy of the OCSP response from the OCSP responder. The web browser simply has to download this copy from the webserver. Therefore, there is no direct contact between the web browser and the OCSP responder. This adds a lot of latency to the connection and doesn\u2019t slow down the browsing experience on the user\u2019s end. Another advantage when it comes to OCSP stapling is its ubiquity. Almost all modern-day web browsers support OCSP by default and therefore you don\u2019t need to enable it manually.<\/p>\n\n\n\n Although OCSP stapling scores 10 out of 10 when it comes to serving its purpose, there is a minor concern about it. If the OCSP responder \u2013 for whatever reason \u2013 gets down, then the web servers won\u2019t be able to generate the latest copy of OCSP response from the responder. Therefore, the browsers won\u2019t get updated about the revocation and could cause serious security concerns.<\/p>\n\n\n\n OCSP is, without a shadow of a doubt, a great technology that helps users stay away of the websites with revoked SSL certificates. And since all modern-day browsers support it by default, you don\u2019t need to enable it by yourself. But, by any chance, if you think that you have disabled it, you can perform the following steps to be on the safer side:<\/p>\n\n\n\n One thing to note here is that OCSP stapling isn\u2019t enabled by default in servers below Windows 2008. Here\u2019s an easy<\/a>, step-by-step guide to enable OCSP stapling in Windows servers.<\/p>\n\n\n\n Protect your website with a RapidSSL single domain or wildcard SSL certificate and get a RapidSSL site seal for free.<\/p>\nSSL Certificate Revocation: The \u201cWhat\u201d and \u201cWhy\u201d<\/h3>\n\n\n\n
OCSP Stapling: The Bridge between the CA and the Browsers<\/h3>\n\n\n\n
Here\u2019s How OCSP Stapling Works in SSL\/TLS Ecosystem<\/h3>\n\n\n\n
This is how OCSP works:<\/h3>\n\n\n\n
Advantages of OCSP Stapling<\/h3>\n\n\n\n
Potential Downside of OCSP Stapling<\/h3>\n\n\n\n
How to Verify If Your Server has OCSP Stapling Enabled<\/h3>\n\n\n\n
Save Up to 82% on RapidSSL Certificates!<\/h2>\n