MOZILLA_PKIX_ERROR_REQUIRED_TLS_FEATURE_MISSING: Must-Staple

MOZILLA_PKIX_ERROR_REQUIRED_TLS_FEATURE_MISSING means the certificate promises that every connection will include a fresh OCSP response, and this connection did not. That promise is called OCSP Must-Staple. Firefox holds the server to it and refuses the connection; other browsers ignore the flag.

Is it the site or your device?

It is the site. Confirm with the SSL checker, which shows whether the certificate has Must-Staple and whether an OCSP response is stapled:

curl ssl.sh/example.com

Visitors cannot fix it. A reload may succeed once the server has fetched a response, which is itself a sign of lazy stapling on the server.

Causes

1. Stapling not enabled

The certificate was requested with Must-Staple (for example certbot --must-staple), but OCSP stapling (ssl_stapling) is off. Check what is sent:

openssl s_client -connect example.com:443 -servername example.com -status </dev/null 2>/dev/null \
  | grep -A3 "OCSP response"

OCSP response: no response sent confirms the problem.

2. Nginx lazy fetching after restart

Nginx retrieves the OCSP response on demand, so connections right after a restart or reload go out without a staple. With Must-Staple, those visitors fail in Firefox.

3. Server cannot reach the OCSP responder

Outbound firewalls, missing resolver directives or DNS issues stop the server from fetching responses.

4. The CA no longer runs OCSP

If the issuing CA has shut down its OCSP service, no staple can ever be fetched. Let's Encrypt stopped accepting Must-Staple requests and turned off OCSP in 2025; a renewal still configured for Must-Staple will fail or produce unusable certificates.

5. TLS terminator without stapling support

Some load balancers and CDNs do not staple at all. A Must-Staple certificate cannot be used there.

What it looks like in each browser

How site owners fix it

Reissuing without Must-Staple is the durable fix, because Let's Encrypt has turned off OCSP.

1. Preferred: reissue without Must-Staple. With certbot, remove the flag from renewal settings and force a new certificate:

sudo sed -i '/must_staple/d' /etc/letsencrypt/renewal/example.com.conf
sudo certbot certonly --nginx -d example.com --force-renewal
sudo systemctl reload nginx

With acme.sh, reissue without --ocsp-must-staple.

2. If you keep Must-Staple, enable stapling and make sure the server can fetch responses:

ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /etc/nginx/ssl/example.com.chain.pem;
resolver 1.1.1.1 8.8.8.8 valid=300s;

Warm the cache after each restart (for example with a few openssl s_client -status requests), or use a server that prefetches responses.

3. Verify with curl ssl.sh/example.com and in Firefox.