OCSP Must-Staple is an X.509 extension, formally the TLS Feature extension with the status_request value, added to a certificate when it is issued. It instructs clients to require a stapled OCSP response during the handshake and to fail the connection if none is present.
Why it matters
Ordinary revocation checking is soft-fail: if the check cannot be completed, browsers carry on. Must-Staple turns it into hard-fail for your site, so a stolen certificate cannot quietly keep working because an attacker blocked the lookup.
The cost is operational risk. If your server stops stapling, restarts without a cached response, or the CA responder goes down, visitors who honor the flag see errors. Because OCSP itself is being retired by some CAs (Let's Encrypt ended its OCSP service in 2025 and stopped supporting Must-Staple requests), check that your CA still supports it before you rely on it.
Example
Request the flag with OpenSSL when generating a signing request:
tlsfeature = status_requestYou can confirm an issued certificate carries it with openssl x509 -in cert.pem -noout -text | grep -i "TLS Feature".
Common mistakes
- Requesting Must-Staple without first confirming stapling works on every server behind the load balancer.
- Restarting a web server and expecting an instant fresh staple. Some servers fetch it lazily.
- Forgetting that the flag stays on the certificate until it is reissued.
Related
Get notified when this term updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.