OCSP stapling lets your server attach a recent, signed statement from the certificate authority saying “this certificate was still good a few hours ago.” The client gets that proof for free instead of going off to ask the CA itself.
SSLBoard reports the status per endpoint, separately from the certificate’s expiry date. The two are unrelated: a perfectly valid certificate can carry a stale staple, and a fresh staple cannot rescue an expired certificate.
The eight results
| Label | What it means | Next step |
|---|---|---|
| Full | Stapling fully available on this endpoint | Read it alongside certificate validity |
| Partial | Only partly available | Check deployment consistency and status refresh |
| None | No stapled response observed | Check whether the certificate and issuer support stapling before changing config |
| Not Available | Not available or not applicable here | Not revocation, and not a failed connection |
| Expired | The attached response has gone stale | Investigate response retrieval, caching, and refresh |
| Unknown | The response reports an unknown certificate status | Take to the issuer and the server operator |
| Bogus | The stapled response is invalid | Review validation and the configured chain |
| Revoked | The response reports revocation | Replace the certificate now and find out why |
Card colors and score rules are not the same scale
The report’s status cards and the scoring rules deliberately disagree, so expect it:
- Cards: Expired, Bogus, and Revoked are critical; Partial, None, and Unknown are warnings; Not Available is informational.
- Score: expired stapling is a protocol warning, revoked stapling hits Certificate Health, and None and Not Available carry no stapling penalty at all.
The point of the split is that a red card is a prompt to read the endpoint evidence, not a verdict. Absent stapling never establishes revocation, and a fresh staple never establishes that the rest of the deployment is right.
Verify the fix
After correcting the certificate or the stapling configuration, run a fresh scan and check the affected endpoint.
If only some addresses improve, the remaining TLS terminators have their own response caches and need the same attention. See certificate deployment for the related checks.