tls.cert.ocsp_stapled
OCSP Stapling Enabled
What we check
We check whether the TLS handshake includes a stapled OCSP (Online Certificate Status Protocol) response. With OCSP stapling, the server fetches the revocation status from the CA's OCSP responder and includes it directly in the TLS handshake, rather than requiring the client to contact the CA separately.
What this finding means
The server staples a valid OCSP response in the TLS handshake. This is the best practice for servers whose certificates include an OCSP responder — it improves performance and privacy for connecting clients.
How it's graded
OCSP stapling is a pass and carries no penalty. See Grading Methodology for the full scoring model.
Evidence example
OCSP response included in TLS handshake:
Status: good
Produced: 2026-08-10T12:00:00Z
This update: 2026-08-10T12:00:00Z
Next update: 2026-08-17T12:00:00Z