What is OCSP stapling?

Question

Options

• AA mechanism that allows a server to provide proof of the revocation status of its own SSL/TLS
• BA mechanism that allows a server to provide proof of the revocation status of all certificates issued
• CA mechanism that allows a server to provide proof of its own identity to clients
• DA mechanism that allows a server to provide proof of a client's identity to other servers

• A
  94% (44)
• B
  2% (1)
• D
  4% (2)

Explanation

OCSP stapling lets a web server proactively fetch a signed, time-stamped response from a Certificate Authority's OCSP (Online Certificate Status Protocol) responder and "staple" it to the TLS handshake - giving clients immediate proof that the server's own certificate has not been revoked, without the client needing to contact the CA directly.

Why the distractors are wrong:

• B is wrong because OCSP stapling only covers the server's own certificate, not "all certificates issued" by a CA - that would describe the CA's OCSP responder itself.
• C is wrong because proving the server's identity is the job of the certificate itself (and the CA signature on it), not stapling - stapling specifically addresses revocation status.
• D is wrong because OCSP stapling is entirely about the server's certificate, not about verifying clients or communicating client identity to other servers.

Memory tip: Think of it like a hotel guest "stapling" a freshly notarized "not expired" stamp to their ID before check-in - the server does the legwork of getting the stamp so guests (clients) don't each have to call the notary (CA) themselves. The key word is own: stapling = the server proving its own cert is still valid.

No community discussion yet for this question.