How to check if OCSP stapling is enabled

Ask for the status during the handshake: openssl s_client -status -connect host:443 -servername host </dev/null. A server that staples answers with an OCSP Response Data block ending in Cert Status: good. A server that does not answers with the single line OCSP response: no response sent.

Why check this

Stapling moves the revocation lookup from the visitor to the server, so a slow or unreachable CA responder stops costing every first-time visitor a round trip. Check it after a TLS configuration change and after a certificate rotation, because a rotation is when stapling most often goes quiet: the server keeps serving, nothing errors, and the cached response for the previous certificate stops matching.

The reason this check is worth running by hand is that stapling has no failure signal. A server that staples nothing completes the handshake exactly like one that staples correctly, serves the same page, and returns the same status code. No log line is written, no monitor fires, and the only party who notices is a client strict enough to fetch the revocation answer itself, which costs that visitor a round trip to a host neither you nor they control. The absence is visible only when something asks for it, which is what the command below does.

Prerequisites

• openssl 1.1.1 or later. -status sends the TLS status_request extension. See the s_client manual.
• The host name for -servername. Stapling is configured per virtual host on most servers, so the wrong SNI reads the wrong configuration.
• One host known to staple, to prove the command works before you trust a negative result.

Steps

1. 1

   Step 1.

   Request the certificate status from a server that staples.

   openssl s_client -status -connect example.com:443 -servername example.com </dev/null 2>&1 | sed -n '/OCSP Response Data/,/Next Update/p'
   

   OCSP Response Data:
     OCSP Response Status: successful (0x0)
     Response Type: Basic OCSP Response
     Version: 1 (0x0)
     Responder Id: C = US, O = SSL Corporation, CN = Cloudflare TLS Issuing ECC CA 3
     Produced At: Sep  9 19:22:00 2026 GMT
     Responses:
     Certificate ID:
       Hash Algorithm: sha1
       Issuer Name Hash: F0E907D20C31F211F5311C95A317FA0B9E01CB6C
       Issuer Key Hash: 8303FDE7F6F54A4D1541F4ED2216D3320A3ECA66
       Serial Number: 0624D0AB311558780B7D5213B9631831
     Cert Status: good
     This Update: Sep  9 19:22:00 2026 GMT
     Next Update: Sep 16 19:22:00 2026 GMT

   Two lines carry the verdict. OCSP Response Status: successful means the CA answered the server. Cert Status: good is the CA speaking about this certificate.

2. 2

   Step 2.

   Run the same request against a server that does not staple.

   openssl s_client -status -connect www.cloudflare.com:443 -servername www.cloudflare.com </dev/null 2>&1 | grep '^OCSP response:'
   

   OCSP response: no response sent

   The handshake succeeds and the page loads. Only this line separates the two configurations.

3. 3

   Step 3.

   Confirm the finding at the TLS extension level, where the server either answers the status_request or stays silent.

   openssl s_client -status -tlsextdebug -connect example.com:443 -servername example.com </dev/null 2>&1 | grep 'status request'
   

   TLS server extension "status request" (id=5), len=346

   Extension 5 with a non-zero length is the stapled response itself, 346 bytes on this connection. On a server without stapling the same grep returns nothing.

4. 4

   Step 4.

   Confirm the stapled response describes the certificate this host actually serves.

   openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -serial
   

   serial=0624D0AB311558780B7D5213B9631831

   This matches the Serial Number inside the stapled response in step 1. A mismatch means the server is stapling a cached answer for a certificate it no longer serves.

5. 5

   Step 5.

   Turn the check into a single exit code for a pipeline.

   curl -sS --cert-status -o /dev/null -w 'http=%{http_code}\n' https://example.com/
   

   http=200

   Exit status 0. Against www.cloudflare.com the same command exits 91 and prints curl: (91) No OCSP response received, which is the form to assert on in CI.

How to read the result

| What you see | What it means | What to do | | --- | --- | --- | | OCSP Response Status: successful and Cert Status: good | Stapling works and the certificate is not revoked | Record the Next Update value and move on | | OCSP response: no response sent | The server never asked the CA, or its cache is empty | Enable stapling, then reload and repeat step 1 | | Cert Status: revoked | The CA says this certificate is dead | Take the host out of rotation now | | OCSP Response Status: tryLater | The CA responder failed and the server passed the failure on | Retry. If it persists, the responder is down, not your server | | Next Update already in the past | A stale response is being served | Restart or reload the server so it refetches, then check its OCSP cache settings |

Thresholds

Common mistakes

What to check next

• How to check certificate revocation: the client-side lookup that stapling is meant to replace.
• How to check certificate chain: the stapled response is signed by the issuer, so a broken chain breaks validation of the staple.
• How to check the TLS handshake: reads the other extensions negotiated in the same connection.
• How to check if a website supports TLS 1.3: the handshake version decides where the stapled response travels.
• SSL certificate checker: reads the chain and validity of a host without a local openssl build.

FAQ

How to check OCSP stapling without openssl?

curl --cert-status https://host/ exits 0 when a stapled response arrives and 91 when none does. It gives a verdict rather than the response body, so the serial number and the update window in step 1 stay out of reach.

Why does a well known site return no response sent?

Because several CAs shut down their OCSP responders during 2025, and a certificate with no OCSP URI leaves the server nothing to staple. On those hosts the absence of a staple is the expected state, not a misconfiguration.

Does OCSP stapling make a site faster?

It removes one lookup to the CA from the first connection of a visitor whose client checks revocation. Clients that skip revocation entirely see no change. Measure the handshake rather than assuming a number.

What does Cert Status good actually prove?

That the CA had not revoked the certificate at the This Update timestamp. It says nothing about later events, which is why Next Update bounds how long the answer may be served.

Should a monitor alert when the staple disappears?

Alert on it only where you know the certificate carries an OCSP URI, because a certificate without one can never be stapled and the alert would fire forever. Read the authority information access extension first, and let that decide whether the host is in scope. Where it is, treat a staple that vanishes after a rotation as the defect it usually is, rather than waiting for a report from a visitor whose client is stricter than your browser.

Verified