Trying to understand OCSP stapling and OCSP must-staple, I've read multiple explanations, but I still don't understand what makes OCSP must-staple secure.

My understanding is that, during TLS, the clients request the server certificate from the (web) server, and the server will send the certificate including the OCSP response for that certificate, and we call that stapling. The OCSP response has been retrieved by server from the OCSP responder whose URL is in the Certificate Authority Information Access extension of the certificate. The response is signed by the CA.

Provided that this is correct, I do not understand why the OCSP response cannot be faked?

If a MITM attacker would be able to exchange the certificate, wouldn't they be able to exchange the OCSP response, too? As explained in various places, the OCSP response is secure because it signed by the CA. But if the attacker was able to create a fake certificate signed by the CA (or a CA), why wouldn't they be able to do the same with a fake OCSP response? What am I missing here?

1 Answer 1


the OCSP response is signed by the CA issuing it. this is essentially the same as requesting the OCSP status from the CA yourself.

the signing with the key of the CA's OCSP key is what make sit so it can not be faked.

it does not protect against a malicious CA. as such it does not impact the security profile to have a OCSP stapled to the TLS handshake.

or in other words, the OCSP can not be faked because the malicious attacker does not have the key to sign his own OCSP with for his malicious CERT.

if the Attacker has a trusted CA that will sign any OCSP request for him... than this protection would be null and void. (as would any other PKI based protection aside from pinning)

  • Does this mean that the root CA of the certificate signer and the root CA of the OCSP response signer cannot be the same?
    – not2savvy
    Commented Nov 15, 2023 at 17:18
  • They can be. But often aren’t the same. They’re typically both signed by the same CA root, but different intermediate. In any case, you need the CA’s OCSP signing certificates key. And you never have that unless you are the CA.
    – LvB
    Commented Nov 15, 2023 at 21:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .