OCSP Must-Staple (TLS Feature extension)

OCSP Must-Staple is an X.509 extension, formally the TLS Feature extension from RFC 7633, whose value lists status_request. It is a promise from the certificate holder that every TLS server using this certificate will provide a stapled OCSP response, so a client may treat a missing staple as a hard failure instead of silently continuing.

Why it matters

Must-Staple was the main attempt to turn OCSP's soft-fail behavior into hard-fail without making every browser query the CA. In practice support stayed narrow: Firefox enforces it and shows an error when the staple is missing, while Chrome ignores the extension. Operating it is fragile, because a responder outage, or a web server that has not yet fetched a response, makes the site unreachable for enforcing clients. The industry has since moved away from OCSP: Ballot SC-063 made OCSP optional for CAs, and Let's Encrypt began rejecting Must-Staple requests on 2025-05-07, when it removed OCSP URLs from new certificates.

Example

Check whether a certificate carries the extension:

openssl x509 -in cert.pem -noout -text | grep -A1 "TLS Feature"

A Must-Staple certificate shows TLS Feature: followed by status_request. No output means the extension is absent.

Common misconceptions

• Must-Staple is a server setting. It is written into the certificate at issuance; the server must then be configured separately for OCSP stapling.
• All browsers enforce it. Chrome does not; enforcement has been mostly limited to Firefox.
• It is still a recommended hardening step. With CAs dropping OCSP, a Must-Staple certificate can no longer be obtained from Let's Encrypt; shorter certificate lifetimes and browser-side revocation lists are the current direction.