Free OCSP Stapling Checker
Free tool
Check if your server staples OCSP responses, validates revocation status, and serves fresh responses. Speeds up TLS handshakes and stops CA leaks.
- OCSP stapling configuration validation
- Certificate revocation status check
- Performance optimization verification
No credit card requiredProduction-safe (100% passive)No setup or code required
Used by 5,000+ developers and engineering teams
What you get for free
18 core security checks via this tool, passive scans, step-by-step remediation, security score on every result.
What Essential adds at $39/mo
+17 advanced checks, continuous monitoring, daily security score history, email alerts, GitHub SAST, board-ready PDFs, SOC 2 / ISO 27001 / PCI reports.
What this checker validates
- OCSP stapling configuration on your server
- Certificate revocation status and response validity
- OCSP response freshness and caching
- Performance impact and optimization opportunities
What is OCSP Stapling?
OCSP stapling allows your web server to provide certificate revocation status directly to clients, eliminating the need for clients to contact the Certificate Authority's OCSP server. This improves both performance and privacy.
How to enable OCSP Stapling
- Apache: Enable mod_ssl and set SSLUseStapling on
- Nginx: Add ssl_stapling on and ssl_stapling_verify on
- Cloudflare and other CDNs: Handled automatically when the certificate's CA provides OCSP
- Check your CA first: Let's Encrypt retired its OCSP responders in 2025 in favor of CRLs, so its certificates cannot be stapled
Benefits of OCSP Stapling
- Faster SSL/TLS handshakes by eliminating OCSP lookups
- Improved privacy by not exposing client IPs to CAs
- Better reliability by reducing dependency on CA OCSP servers
- Enhanced security through real-time revocation checking
Implementation examples
Stapling is enabled at whatever terminates your TLS. One thing to check before touching config: it only works when your CA still runs OCSP responders. Many commercial CAs do, but Let's Encrypt dropped OCSP in 2025, so with its certificates there is nothing to staple. Here are the two most common server configs, plus a quick way to confirm it works.
Nginx
server {
listen 443 ssl;
ssl_certificate /etc/ssl/fullchain.pem;
ssl_certificate_key /etc/ssl/privkey.pem;
ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /etc/ssl/chain.pem;
resolver 1.1.1.1 8.8.8.8 valid=300s;
resolver_timeout 5s;
}Apache
# httpd.conf / ssl.conf
SSLUseStapling on
SSLStaplingResponderTimeout 5
SSLStaplingReturnResponderErrors off
SSLStaplingCache shmcb:/var/run/ocsp(128000)Verify with OpenSSL
openssl s_client -connect example.com:443 -status < /dev/null \
| grep -A 2 "OCSP Response"
# A working setup prints: OCSP Response Status: successfulNode.js has no practical built-in stapling support. If your app serves TLS directly, terminate it at nginx, Apache, a load balancer, or a CDN instead and let that layer handle stapling.
Tool-specific questions
Is OCSP stapling required for security?
While not strictly required, OCSP stapling is a security best practice that improves both performance and privacy. It's especially important for high-traffic websites.
What happens if OCSP stapling fails?
With CAs that still run OCSP responders, clients fall back to traditional OCSP lookups, which may slow down SSL handshakes and expose client IPs to Certificate Authorities. For CAs without OCSP, such as Let's Encrypt, browsers rely on CRL-based revocation instead.
Can I use OCSP stapling with Let's Encrypt?
Not anymore. Let's Encrypt ended OCSP support in 2025 and publishes CRLs instead, so its certificates cannot be stapled. Stapling still works with CAs that operate OCSP responders, such as most commercial CAs.
How often should I check OCSP stapling status?
Regular monitoring is recommended, especially after server configuration changes. Use Barrion's continuous monitoring to track OCSP stapling status over time.
Why Barrion
Built for the engineers who already have enough to fix.
Speed
Real-time results
Instant analysis with a detailed report. You see findings as the scan runs, not after.
Coverage
Comprehensive checks
35+ checks per scan covering TLS, headers, CORS, cookies, DNS, email auth, and more, in a single pass.
Action
Step-by-step fixes
Every finding ships with the exact remediation step for your framework. Hand it to the engineer who owns the surface.
Other tools
More free checks, for the rest of your surface.
Complete Security Scan
Complete website security analysis with comprehensive vulnerability detection
Pre-Pentest Security Scan
Passive scan that catches the misconfigurations a pentester finds first. Use it before a manual engagement to clear the easy issues.
Security Compliance Checker
Check compliance with PCI DSS, HIPAA, SOC 2, ISO 27001, and GDPR. Get compliance readiness reports.
WAF Checker
Detect Web Application Firewall presence through passive header analysis. Identify WAF/CDN providers.
Security Headers Test
Check your website's HTTP security headers configuration
TLS/SSL Security Checker
Validate your SSL/TLS configuration and certificate setup
FAQ
Frequently asked.
What is Barrion and how does it enhance website security?
Barrion is a security testing and monitoring platform for engineering teams, and it works in three ways. Passive scanning keeps a continuous, read-only watch over your live web apps and APIs. Codebase scanning connects to GitHub and checks your code for hard-coded secrets, insecure patterns and vulnerable dependencies. AI pentesting goes on the offensive, running agent-driven attacks that prove which vulnerabilities are genuinely exploitable. Every finding comes with a step-by-step fix you can ship right away.
How safe is Barrion to use for security testing?
Passive scanning and codebase scanning are completely safe to run, including against production. Passive scans only read your live app, so we never submit forms, brute-force endpoints or touch anything that changes state, and codebase scanning just reads your repository. AI pentesting is more aggressive by design, since its job is to confirm real exploits, so it runs rate-limited and non-destructive, and you approve the exact scope before a single request is sent.
What types of security issues does Barrion identify?
It depends on the surface. On your live apps, Barrion catches misconfigurations across TLS and HTTPS, security headers, cookie flags, CORS policy, DNS records, email authentication (SPF, DKIM, DMARC), network exposure and the usual web hygiene gaps. In your codebase it finds secrets committed to the repo, insecure code patterns and vulnerable dependencies. AI pentesting surfaces the exploitable stuff, like SQL injection, cross-site scripting and broken access control, each one backed by proof it can actually be exploited.
What specific security checks does Barrion perform?
For live apps it checks TLS and HTTPS configuration, HTTP security headers, cookie flags, CORS policy, DNS and email authentication records, network exposure and common web hygiene issues. In your codebase it looks for hard-coded secrets, insecure patterns and vulnerable dependencies. AI pentesting takes it further by actively chaining requests to confirm exploitable flaws. Whatever the source, findings are ranked by severity and come with clear, step-by-step remediation.
What is Barrion's smart crawling?
Smart crawling automatically discovers the pages and endpoints of your app so scans cover the surface that matters, without you manually listing every URL.
How often does Barrion perform security scans?
You can run a scan manually whenever you want. Continuous monitoring of your live apps runs on its own (weekly and up on Essential, daily on Business), codebase scans can fire on every commit or pull request, and we alert you the moment something new shows up.
Is Barrion suitable for security testing of all business sizes?
Yes. Live-app monitoring, codebase scanning through GitHub and AI pentesting all work just as well for a solo developer as for a startup, a scale-up or an enterprise security team, without adding headcount.
How does Barrion handle data security and privacy during security testing?
Live-app and codebase scans are read-only by default, and we never store or expose sensitive data from your application. AI pentests are rate-limited and non-destructive, built to confirm whether something is exploitable without altering your data or affecting availability.
What if I'm not satisfied with Barrion's security testing service?
Paid plans start with a free trial, and you can cancel anytime. If something isn't right, contact us and we'll make it work for your team.
How does Barrion help with SOC 2, ISO 27001, NIS2, and other compliance frameworks?
Barrion produces audit-ready PDF and CSV reports suitable for SOC 2, ISO 27001, PCI DSS and NIS2, ready to share with auditors, customers and your board.
Anything else? Email contact@barrion.io.