Question: OCSP stapling decreases the load on a PKI infrastructure's OCSP server by attaching a signed OCSP response to the target in a TLS connection. In addition it creates a more secure/private session since the CA doesn't know that your browser is accessing a given site. Some people have compared this behavior to Kerberos.

**Question**

* What web browsers support OCSP stapling?
* Are there any implementation considerations among different browsers that need to be addressed to maintain uniform privacy and performance benefits?

Answer: 
You can test OCSP stapling support in Your browser on <http://www.vpnhosting.cz/ocsp>.

It is in Czech language, if You can see OCSP\_stapling\_disabled, OCSP stapling is disabled, OCSP\_stapling\_enabled means, that OCSP stapling works.
Even with OCSP stapling, the act of verifying the OCSP signature may expose personal information to the OCSP signing root. Additionally the OCSP singing root can be a 3rd party to the entire infrastructure as shown here:

![PKI hierarchy with two roots](https://i.stack.imgur.com/T0ESx.gif)

[source](http://technet.microsoft.com/en-us/library/ee619784%28v=ws.10%29)

Although there are security benefits to validating the signing OCSP signature, if privacy concerns outweigh security the following extension disables the signing functionality `szOID_PKIX_OCSP_NOCHECK (1.3.6.1.5.5.7.48.1.5)` (note it is up to the CA to implement this extension)

If you want to use CRL instead of OCSP, you can set the following setting to 1 or zero on a Windows machine

```
 HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates\ChainEngine\Config\CryptnetCachedOcspSwitchToCrlCount

```