OCSP stapling moves status evidence closer
Checking whether a certificate has been revoked normally means the browser asking a third party, which is slow and leaks which sites you visit.
Stapling has the server fetch that answer itself and hand it over with the certificate. Faster, more private, and it works when the checking service is unreachable. It is a small piece of plumbing that quietly removes a dependency from every page load.
More on TLS and PKI
- TLS encrypts a connection, not endpoint intentionsA sealed pipe to a stranger
- Certificates bind keys to names through trust chainsHeld together by a chain of seals
- Certificate expiry creates operational pressureEvery one of them runs out
- Private-key compromise survives a valid certificateThe certificate is fine
- HSTS removes the insecure choice after a browser has learned the policy, while preload can protect the first visit tooThe turning that stops existing
- Mutual TLS authenticates both endsBoth of you show papers