Feature Overview

Online Certificate Status Protocol (OCSP) is an interface provided by a certificate authority (CA) for querying certificate status. OCSP provides a real-time response mechanism. After the CA server receives a certificate query request from a client, the CA server checks whether the certificate is valid and responds in real time. During the SSL handshake, the client queries OCSP information in real time and blocks the subsequent process before it obtains a query result. This may cause a blank page for a relatively longer period of time in weak network conditions and decrease HTTPS performance, resulting in a poor user experience.

After OCSP stapling is enabled, CDN queries certificate status information and caches query results in its servers. When a client sends an SSL/TLS handshake request to a CDN server, the CDN server sends the certificate status information together with the certificate to the client for verification. The client does not need to send a request to the corresponding certificate authority (CA) to query information about the certificate. This effectively improves the SSL/TLS handshake efficiency and the HTTPS performance.

The OCSP stapling process does not bring extra security risks because OCSP responses cannot be fabricated.

Applicable Scenarios

After you enable HTTPS, you want to improve the TLS handshake efficiency and the HTTPS performance to improve access speed and user experience.

Additional Considerations

Before you enable the OCSP stapling feature, you must enable HTTPS.
By default, the OCSP stapling feature is disabled.
By default, the validity period of certificate status information caches is one hour. After a cache is expired, OCSP stapling does not take effect for the first new request.
The client must support the OCSP-related extended fields. If the client does not support the OCSP-related extended fields, this feature does not take effect.

Procedure

Log in to the CDN console.
Go to Domain Management -> Domain List.
On the Domain Names page, find the target domain name, and click Edit in the Actions column.
Click HTTPS .
Turn on the HTTPS switch.
Select certificate.
Enable OCSP stapling.
Click Save and submit.

Content Delivery Network

OCSP Stapling