tls.cert.ocsp_not_applicable
OCSP Stapling Not Applicable
What we check
Before judging whether a server staples an OCSP response, we check the certificate's Authority Information Access (AIA) extension for an OCSP responder URL. This finding fires when the certificate names no OCSP responder — there is nothing to staple.
What this finding means
The certificate does not include an OCSP responder URL, so OCSP stapling cannot apply to this server. This is not a misconfiguration — the certificate authority chose not to publish an OCSP endpoint.
The most common cause: Let's Encrypt retired its OCSP responders in 2025 and switched to CRL-only revocation. Certificates issued since the retirement carry no OCSP responder in their AIA extension. Since Let's Encrypt certifies the majority of Postfix and Mailcow installations, this finding is increasingly common.
Why it matters
- Not actionable. The server operator cannot add an OCSP responder to a certificate — that is the CA's decision at issuance time. Telling administrators to "enable OCSP stapling" when there is no responder to staple from would be misleading.
- Revocation still works. CRL-based revocation remains available. The retirement of OCSP does not mean revocation checking is impossible — it means one of the two mechanisms is not offered.
How it's graded
OCSP not applicable is informational and carries no penalty. See Grading Methodology for the full scoring model.
Evidence example
Certificate issuer: R11 (Let's Encrypt)
Authority Information Access:
CA Issuers: http://r11.i.lencr.org/
OCSP: (none — retired)