OCSP stapling checks a certificate without a round trip
Pushing the check to the server removes a whole round trip and a separate request, though a missing staple still lets clients fall back and query. The server fetches once OCSP stapling is about the client skipping a validation round-trip. When a client checks a TLS cert, it would normally ask the CA’s OCSP responder ‘is this certificate still good?’ — a query that adds latency and a dependency on a Certificate Authority being reachable. With stapling, the server fetches that signed OCSP response once, caches it, and simply sends it along inside the TLS handshake (certificate_status extension). The browser no longer needs the extra network call, so validation gets cheaper and the failure modes of the OCSP responder stop slowing every handshake. ...