# MOZILLA_PKIX_ERROR_REQUIRED_TLS_FEATURE_MISSING: Must-Staple

> Firefox shows MOZILLA_PKIX_ERROR_REQUIRED_TLS_FEATURE_MISSING when a Must-Staple certificate arrives without a stapled OCSP response. How to fix it.

Source: https://ssl.sh/errors/mozilla-pkix-error-required-tls-feature-missing/
Last updated: 2026-11-10

**MOZILLA_PKIX_ERROR_REQUIRED_TLS_FEATURE_MISSING means the certificate promises that every connection will include a fresh OCSP response, and this connection did not.** That promise is called [OCSP Must-Staple](https://ssl.sh/glossary/must-staple/). Firefox holds the server to it and refuses the connection; other browsers ignore the flag.

## Is it the site or your device?

It is the site. Confirm with the [SSL checker](https://ssl.sh/tools/ssl-checker/), which shows whether the certificate has Must-Staple and whether an OCSP response is stapled:

```bash
curl ssl.sh/example.com
```

Visitors cannot fix it. A reload may succeed once the server has fetched a response, which is itself a sign of lazy stapling on the server.

## Causes

### 1. Stapling not enabled

The certificate was requested with Must-Staple (for example `certbot --must-staple`), but [OCSP stapling](https://ssl.sh/glossary/ocsp-stapling/) (`ssl_stapling`) is off. Check what is sent:

```bash
openssl s_client -connect example.com:443 -servername example.com -status </dev/null 2>/dev/null \
  | grep -A3 "OCSP response"
```

`OCSP response: no response sent` confirms the problem.

### 2. Nginx lazy fetching after restart

Nginx retrieves the OCSP response on demand, so connections right after a restart or reload go out without a staple. With Must-Staple, those visitors fail in Firefox.

### 3. Server cannot reach the OCSP responder

Outbound firewalls, missing `resolver` directives or DNS issues stop the server from fetching responses.

### 4. The CA no longer runs OCSP

If the issuing CA has shut down its OCSP service, no staple can ever be fetched. Let's Encrypt stopped accepting Must-Staple requests and turned off OCSP in 2025; a renewal still configured for Must-Staple will fail or produce unusable certificates.

### 5. TLS terminator without stapling support

Some load balancers and CDNs do not staple at all. A Must-Staple certificate cannot be used there.

## What it looks like in each browser

| Browser | What you see |
|---|---|
| Firefox | "Secure Connection Failed" with `MOZILLA_PKIX_ERROR_REQUIRED_TLS_FEATURE_MISSING` |
| Chrome / Edge | Loads normally (Must-Staple is not enforced) |
| Safari | Loads normally |

## How site owners fix it

Reissuing without Must-Staple is the durable fix, because Let's Encrypt has [turned off OCSP](https://ssl.sh/news/lets-encrypt-ends-ocsp/).

**1. Preferred: reissue without Must-Staple.** With certbot, remove the flag from renewal settings and force a new certificate:

```bash
sudo sed -i '/must_staple/d' /etc/letsencrypt/renewal/example.com.conf
sudo certbot certonly --nginx -d example.com --force-renewal
sudo systemctl reload nginx
```

With acme.sh, reissue without `--ocsp-must-staple`.

**2. If you keep Must-Staple,** enable stapling and make sure the server can fetch responses:

```nginx
ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /etc/nginx/ssl/example.com.chain.pem;
resolver 1.1.1.1 8.8.8.8 valid=300s;
```

Warm the cache after each restart (for example with a few `openssl s_client -status` requests), or use a server that prefetches responses.

**3. Verify** with `curl ssl.sh/example.com` and in Firefox.