My primitive understanding of OCSP is that:
- Assertions are signed by the CA and valid for a short period.
- Stapling refers to the practice of pushing the OCSP request work onto the webserver, and then caching the (CA signed) response and spitting it back out to clients using the "status request" extension.
- The OCSP server may be down, in which case it may not be possible to get a successful response to staple.
I'm seeing OpenSSL report that the server is sending this OCSP data:
OCSP response: ====================================== OCSP Response Data: OCSP Response Status: trylater (0x3) ======================================
Why would this ever happen? Surely the webserver should be sending the last valid, successful OCSP response it has cached? Hell, isn't sending nothing at all (and having the browser do the request itself) preferable to stapling trylater?