Cybersecurity
14 Sep 2026
6 min read
OCSP Stapling Moves Revocation Evidence Closer to the TLS Handshake
OCSP Stapling Moves Revocation Evidence Closer to the TLS Handshake A browser can receive a valid certificate chain, verify every signature, confirm the hostname, and still face one more question: has the issuing certificate authority revoked the leaf certificate since it was issued? That question is awkward because the certificate itself cannot carry a fresh answer. Its signed validity interval is fixed at issuance, while revocation is an event that can happen later.