tls.cert.ocsp_not_stapled

No OCSP Stapling

What we check

We check whether the TLS handshake includes a stapled OCSP response, having first confirmed that the certificate names an OCSP responder to staple from. This finding fires when the certificate has an OCSP responder but the server does not staple.

What this finding means

The server does not include an OCSP response in the TLS handshake, even though the certificate provides an OCSP responder URL. Without stapling, clients that want to check revocation status must contact the CA's OCSP responder themselves.

Why it matters

Client privacy. Without stapling, every connecting client reveals to the CA which certificates it is checking — a privacy concern, especially at scale.
Added latency. Clients must make an extra network round-trip to the CA's OCSP responder to check revocation status.
Limited practical impact for SMTP. Most sending MTAs do not perform OCSP checks during opportunistic TLS. This is primarily relevant for the quality of the TLS deployment, not for mail delivery.
OCSP is being sunset. Let's Encrypt retired its OCSP responders in 2025 in favor of CRL-only revocation. Newer certificates from Let's Encrypt have no OCSP responder at all (see tls.cert.ocsp_not_applicable).

How to fix

Enable OCSP stapling in your mail server. For Postfix (2.11.0+):
```
# /etc/postfix/main.cf
smtp_tls_enable_rpk = no
```
Note: Postfix does not natively support OCSP stapling as of current versions. This is a known limitation of the Postfix TLS implementation.
For other mail servers that support OCSP stapling (e.g., some configurations of Exim, or mail servers behind HAProxy/nginx):
```
# nginx (as TLS terminator)
ssl_stapling on;
ssl_stapling_verify on;
resolver 8.8.8.8 1.1.1.1 valid=300s;
```
Consider the trade-off. If your certificate is from Let's Encrypt (most Postfix/Mailcow installations), the CA has retired OCSP — the next certificate renewal will remove the responder entirely, making this finding inapplicable.

How it's graded

No OCSP stapling is informational and carries no point deduction. See Grading Methodology for the full scoring model.

Evidence example

$ openssl s_client -starttls smtp -connect mail.example.com:25 \
    -servername mail.example.com -status 2>/dev/null | grep "OCSP"
OCSP response: no response sent