OCSP stapling

There are two challenges with OCSP. The first aspect is the privacy part and the second aspect is the slowness part.

Challenge 1

When a browser sends an OCSP request to the CA servers, the CA will know which client is accessing which domain. This may breach the privacy part. This is illustrated in the following diagram:

1. A web server has sent its Certificate to the user.
2. The users query the OCSP Responder to check if the Certificate for the Domain is Valid or not.
3. The OCSP Responder responds, depending on the status.

In the backend, the OCSP Responder can also store the IP of the client and the Domain it is accessing. This can give great detail as to who is accessing which website as well as many other details...