---
title: "WEB-APA-007 Apache OCSP Stapling Not Enabled"
canonical: https://openvapt.com/checks/WEB-APA-007.html
html: https://openvapt.com/checks/WEB-APA-007.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-14
version: 0.1.0-alpha.6
---

# WEB-APA-007 Apache OCSP Stapling Not Enabled

A TLS-enabled Apache does not set SSLUseStapling on.

- Domain: Web Apps
- Severity: Low
- Control category: Cryptography and TLS
- Fix effort: low
- CVSS v3.1 vector: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N`
- CIS Controls v8: 3.10
- NIST CSF 2.0: PR.DS-02
- CWE: CWE-299
- OWASP Top 10 2021: A02:2021
- OWASP ASVS 4.0.3: 9.2.4
- OWASP WSTG v4.2: WSTG-CRYP-01
- NIST SP 800-53 Rev. 5: SC-8, SC-17
- Benchmark topic: Certificate status checking (topic only, no benchmark text)

## Why It Matters

Without stapling, every browser asks the certificate authority whether the certificate is revoked, which slows the handshake and reveals the visited site to the CA. Stapling lets the server attach a fresh signed status itself.

## How It Detects

When SSLEngine on or SSLCertificateFile is present, reads SSLUseStapling and SSLStaplingCache. Fails unless SSLUseStapling is on.

## How to Fix

Add  SSLUseStapling On  inside the vhost and  SSLStaplingCache "shmcb:logs/ssl_stapling(32768)"  outside it, as the Mozilla generator produces.

## How to Verify

```
openssl s_client -connect 127.0.0.1:443 -servername <site> -status  should print OCSP Response Status: successful.
```

## Learn the Theory

- [P18 Web Server Hardening: nginx and Apache](https://openvapt.com/academy/p18.md)

## References

- [Apache HTTP Server, SSLUseStapling directive](https://httpd.apache.org/docs/2.4/mod/mod_ssl.html#sslusestapling)
- [Mozilla SSL Configuration Generator](https://ssl-config.mozilla.org/)

## Source Code

https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/serverconf.go

Run it: `openvapt scan --only WEB-APA-007`. Read it offline: `openvapt explain WEB-APA-007`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/checks/WEB-APA-007.html. Part of OpenVAPT Check Catalogue. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.