OCSP stapling lets a TLS server attach a certificate-status response to its handshake. SSLBoard reports the returned status at endpoint level, separate from the certificate’s expiration date.
Result reference
| Label | Interpretation | Next step |
|---|---|---|
| Full | Stapling was reported as fully available for the assessed endpoint. | Review alongside certificate validity. |
| Partial | Stapling is only partly available in the assessment. | Inspect deployment consistency and status refresh. |
| None | No stapled response was observed. | Check whether the certificate and issuer support stapling before changing configuration. |
| Not Available | Stapling is not available or not applicable in this context. | Do not interpret this as revocation or a failed connection. |
| Expired | The attached status response is stale. | Investigate response retrieval, caching, and refresh. |
| Unknown | The response reports an unknown certificate status. | Investigate with the issuer and server operator. |
| Bogus | The stapled response is invalid. | Review validation and the configured certificate chain. |
| Revoked | The response reports revocation. | Replace the certificate and investigate the revocation. |
How urgency and scoring differ
The report’s status cards classify Expired, Bogus, and Revoked as critical, Partial, None, and Unknown as warnings, and Not Available as informational. The score uses its own rules: expired stapling is a protocol warning, for example, while revoked stapling affects Certificate Health. None and Not Available do not receive their own stapling penalty in the current score.
These differences make the endpoint evidence more useful than relying on a color alone. The absence of stapling does not establish that a certificate is revoked, and a fresh response does not prove all aspects of the deployment are correct.
Verify the fix
After correcting the certificate or stapling configuration, run a fresh scan and check the affected endpoint’s status. If only some addresses improve, inspect the remaining TLS terminators and their response caches. See certificate deployment for related checks.