What OCSP stapling solves
Every HTTPS certificate has a lifespan, but a certificate authority can pull it back early if the private key leaks or the certificate was issued by mistake. Browsers need a way to learn about that revocation before they trust a site. The Online Certificate Status Protocol, OCSP, is the answer. It lets a browser ask the certificate authority a simple question, is this certificate still good, and get a signed reply.
The classic version of that check has two problems. It is slow, because the browser opens a fresh connection to the authority in the middle of loading a page, and it leaks privacy, because the authority learns which sites a visitor is browsing. Many browsers also fail open, treating an unreachable authority as if the certificate were fine, which weakens the protection it was meant to give.
How stapling makes it faster and more private
OCSP stapling moves the work to the server. The server itself asks the certificate authority for a fresh signed status, caches it, and attaches that staple directly to the TLS handshake. The browser reads the answer it needs from the handshake it was already performing, so there is no second round trip and the certificate authority never sees the visitor at all. The status is still signed by the authority, so the server cannot forge it.
How to enable OCSP stapling
On Nginx, set ssl_stapling on; and ssl_stapling_verify on; inside the server block, then point ssl_trusted_certificate at the full issuer chain so Nginx can verify the staple. On Apache, enable SSLUseStapling on with an SSLStaplingCache defined at the server level, then reload. Once the server is reloaded, run this checker again to confirm a stapled response is being served, and pair it with the SSL/TLS handshake checker for the rest of your TLS configuration.