and start serving bad response. Nginx performs lazy loading of OCSP responses, which means that for the first few web requests it is unable to add the OCSP response. On the browser side, OCSP stapling was implemented in Firefox 26, in Internet Explorer since Windows Vista, and Google Chrome in Linux, ChromeOS, and Windows since Vista. For SMTP the Exim message transfer agent supports OCSP stapling in both client and server modes. Limitations OCSP stapling is designed to reduce the cost of an OCSP validation, both for the client and the OCSP responder, especially for large sites serving many simultaneous users. However, OCSP stapling supports only one OCSP response at a time, which is insufficient for certificate chains with intermediate CA certs. This limitation has been addressed by Multiple Certificate Status Request Extension, specified in . It adds the support for sending multiple OCSP responses. TLSv1.3 automatically removes this limitation, making browser support for moot, as more and more web servers drop support for TLS 1.2. Under TLS 1.2 only one stapled response can be sent by a server, the OCSP response associated with the end-certificate. Under TLS 1.3 a server can send multiple OCSP responses, typically one for each certificate in the certificate chain. References Cryptographic protocols Internet Standards Internet protocols Transport Layer Security