We received recently security report with [low] security issue: Missing "Must-Staple" extension on certificate.

With help of old article oscp-must-staple I managed to create CRA with extension.

Requested Extensions:
  X509v3 Basic Constraints:
  X509v3 Key Usage:
    Digital Signature, Non Repudiation, Key Encipherment

But when we generate new certificate it does not contain this extension. We verify it by:

openssl s_client -showcerts -connect web.page.com:443 </dev/null 2>/dev/null|openssl x509 -text -noout | grep

I checked other websites and with this command I am not able to find websites which use this extension. For example: when I check this way facebook, amazon or bank pages, they do not use must-staple.

Is this still relevant extension on certificates in 2021? Most articles about this are 5 years old.

  • Which CA issued your certificate? Oct 18 '21 at 12:23
  • We have certificate from GoDaddy. Oct 18 '21 at 12:26
  • 1
    "But when we generate new certificate it does not contain this extension." - the CSR is only a recommendation on how the final certificate should look like. It is up to the CA which content and extensions are added to the new certificate. For the browser it does not matter what it is in the CSR, all what matters is the content of the certificate itself. Oct 18 '21 at 16:32
  • 1
    Cabforum BR since 1.7.1 2020-Aug requires CA specifies in subscriber (leaf) certs (and provides) OCSPresponder, but is silent on stapling vs clientside and does not mention must-staple. Before that it allowed CA to omit OCSPresponder from cert (only) if it required stapling 'contractually or by technical review' -- not by must-staple. NIST SP800-52r2 2019-08 requires the server support (v1) stapling; it describes the must-staple extension but doesn't require or even recommend it. And I've never noticed any CA issuing it; maybe censys or ssllabs or such could help there. Transparency OTOH .... Oct 19 '21 at 6:49
  • Agree with Steffen on this. It's all nice that you can include it in your CSR, but you should check if your CA supports it beforehand, otherwise it may simply be ignored or even rejected. Personally, I would be happier if it was rejected with a specific reason as you would at least not end up with a certificate that doesn't contain the extensions that you explicitly added. Oct 20 '21 at 10:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.