if the client receives an invalid stapled response, it will abort the connection. The only increased risk of OCSP stapling is that the notification of revocation for a certificate may be delayed until the last-signed OCSP response expires. As a result, clients continue to have verifiable assurance from the certificate authority that the certificate is presently valid (or was quite recently), but no longer need to individually contact the OCSP server. This means that the brunt of the resource burden is now placed back on the certificate holder. It also means that the client software no longer needs to disclose users' browsing habits to any third party. Overall performance is also improved: When the client fetches the OCSP response directly from the CA, it usually involves the lookup of the domain name of the CA's OCSP server in the DNS as well as establishing a connection to the OCSP server. When OCSP stapling is used, the certificate status information is delivered to the client through an already established channel, reducing overhead and improving performance. Specification The TLS Certificate Status Request extension is specified in , Section 8. defines a Multiple Certificate Status Request extension, which allows a server to send multiple OCSP responses in the TLS handshake. A draft proposal for an X509v3 extension field, which expired in April 2013, specified that a compliant server presenting a certificate carrying the extension must return a valid OCSP token in its response if the status_request extension is specified in the TLS client hello. The current version of the proposal has been extended to support additional TLS extensions. TLS developer Adam Langley discussed the extension in an April 2014 article following the repair of the Heartbleed OpenSSL bug. Deployment OCSP stapling support is being progressively implemented. The OpenSSL project included support in their 0.9.8g release with the assistance of a grant from the Mozilla Foundation. Apache HTTP Server supports OCSP stapling since version 2.3.3, the nginx web server since version 1.3.7, LiteSpeed Web Server since version 4.2.4, Microsoft's IIS since Windows Server 2008, HAProxy since version 1.5.0, F5 Networks BIG-IP since version 11.6.0, KEMP LoadMasters since Version 7.2.37.1, and lighttpd since version 1.4.56. While many web servers advertise support for OCSP stapling, implementations are not always reliable. For example, when Apache queries the OCSP server, in the event of a temporary failure, it will discard the cached good response from the previous request,