OCSP Must-Staple Checker

Check if certificate has OCSP must-staple extension

About OCSP Must-Staple

OCSP Must-Staple is a certificate extension (defined in RFC 7633) that tells clients the server must provide an OCSP stapled response during the TLS handshake. This ensures certificate revocation status is checked in real-time rather than relying on CRLs or client-initiated OCSP requests, which can be privacy-invasive and slow. Our Must-Staple Checker verifies whether a certificate includes this critical extension.

How to Use

Enter the domain name of the server you want to check.
Adjust the port number if the service runs on a non-standard port.
Click Check to fetch the certificate and analyze its extensions.
Review the result to see if the Must-Staple extension is present and whether OCSP stapling is properly configured.

Use Cases

Certificate Procurement: Verify that newly issued certificates include the Must-Staple extension for enhanced security.
Server Hardening: Ensure your servers are configured to provide OCSP stapled responses when the certificate requires it.
Security Auditing: Check that all certificates in your infrastructure comply with OCSP Must-Staple requirements.
Browser Compatibility: Confirm that Must-Staple certificates are correctly served to avoid browser warnings.

Frequently Asked Questions

OCSP Must-Staple is a TLS certificate extension that requires the server to provide an OCSP response (staple) during the TLS handshake. Without it, the client must fetch revocation status separately, which can fail silently or leak privacy.

Regular OCSP stapling is optional and configured server-side. Must-Staple is a certificate extension that makes stapling mandatory. Browsers that support Must-Staple will reject connections if the server fails to provide a valid OCSP staple.

Yes, if your server infrastructure supports OCSP stapling properly. Must-Staple improves security by ensuring revocation status is always checked. However, ensure your servers are configured correctly, or clients may fail to connect.

Tips & Best Practices

•Must-Staple requires OCSP stapling to be enabled on your server
•Ensure your server can fetch fresh OCSP responses before enabling Must-Staple
•Test OCSP stapling functionality before deploying Must-Staple certificates
•Monitor OCSP response freshness to avoid serving stale responses

Technical Details

Extension: TLS Feature extension (RFC 6962) detection
OCSP: Online Certificate Status Protocol integration requirements
Validation: Certificate extension analysis and configuration verification
Servers: Nginx, Apache, and HAProxy OCSP stapling support