News
OCSP Stapling vs Must-Staple for Public Certificates
November 5, 2024
OCSP stapling vs Must-Staple for public certificates is a server-sent revocation hint versus a certificate extension that demands it. Stapling (OCSP in the TLS handshake) saves clients a trip to the CA and hides those lookups from observers. Must-Staple (RFC 7633 / TLS feature) tells supporting clients to fail closed if the staple is missing. That is a reliability commitment, not a roast finding. Certificate Transparency logging is a different disclosure channel — see Expect-CT vs CT. RoastMyOpsec confirms HTTPS and the runtime trust store. It does not fetch OCSP, does not parse Must-Staple, and does not score missing staples.
The practical difference
Stapling is configuration on the edge. Must-Staple is burned into the leaf at issuance. Turning off stapling after Must-Staple is how you lock out browsers that honor it. HSTS plus an expired leaf is a related lockout class — fix renewal first.
TLS 1.3 still can staple. Cipher-suite beauty contests are separate — see TLS 1.2 vs 1.3.
How to choose a policy
Most brochure sites: enable stapling on the CDN if the vendor supports it and monitors staple freshness. Skip Must-Staple unless you operate a PKI team that pages on staple failures. Do not copy Must-Staple from an internal mTLS profile onto a marketing cert.
| Control | Where it lives | Failure mode | Takeaway |
|---|---|---|---|
| OCSP stapling | TLS handshake / edge | Stale staple or origin timeout | Ops win; not a roast F |
| Must-Staple | Certificate extension | Missing staple → hard fail | Optional; high commitment |
| Certificate Transparency | Public logs | Unexpected certs in CT | See Expect-CT vs CT |
| HSTS | Browser memory | Expired cert + preload | See expiry vs HSTS |
What the roast can prove
Trust-store acceptance of the leaf you were served. Staple presence is out of scope. Confirm in the CDN dashboard. Pair with CAA if issuance is the worry, not stapling.
Common mistakes
The first mistake is Must-Staple on a CDN that sometimes skips OCSP.
The second mistake is disabling stapling to 'fix' an intermittent 5xx.
The third mistake is treating missing staples as a roast vulnerability.
Free audit the URL you own
RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.
Free audit nowFAQ
- Is missing OCSP stapling a vulnerability?
- It is an ops and privacy miss, not an automatic F. Clients may still check OCSP themselves.
- Should brochure sites request Must-Staple?
- Usually no until stapling is proven reliable. Missing Must-Staple is not a roast F.
- Does RoastMyOpsec check OCSP?
- No. It does not fetch OCSP responders or parse Must-Staple.