We received recently security report with [low] security issue: Missing "Must-Staple" extension on certificate.
With help of old article oscp-must-staple I managed to create CRA with extension.
Requested Extensions: X509v3 Basic Constraints: CA:FALSE X509v3 Key Usage: Digital Signature, Non Repudiation, Key Encipherment 188.8.131.52.184.108.40.206.24: 0....
But when we generate new certificate it does not contain this extension. We verify it by:
openssl s_client -showcerts -connect web.page.com:443 </dev/null 2>/dev/null|openssl x509 -text -noout | grep 220.127.116.11.18.104.22.168.24
I checked other websites and with this command I am not able to find websites which use this extension. For example: when I check this way facebook, amazon or bank pages, they do not use must-staple.
Is this still relevant extension on certificates in 2021? Most articles about this are 5 years old.