EXERCISE 3 — OCSP stapling, and the SSL Labs A+ checklist
=========================================================

WHAT OCSP STAPLING IS:
  - Revocation check = confirming a certificate hasn't been revoked before
    its expiry (Chapter 11). OCSP (Online Certificate Status Protocol) is a
    way to ask the CA "is this cert still good?"
  - WITHOUT stapling, the BROWSER contacts the CA's OCSP responder itself
    during the handshake.
  - WITH stapling, the SERVER periodically fetches a fresh, CA-SIGNED status
    response ("good, valid until ...") and STAPLES it into the TLS
    handshake. The browser gets the proof directly from the server and
    trusts it because the CA signed it (and it's short-lived/timestamped).

THE THREE PROBLEMS IT SOLVES vs the browser doing its own OCSP lookup:
  1. SPEED / LATENCY: a browser OCSP lookup is an extra network round trip
     to the CA mid-handshake, slowing page load. Stapling removes it -- the
     status arrives inside the handshake already.
  2. PRIVACY: a browser OCSP query tells the CA which site the user is
     visiting (and when). Stapling means the CA never sees the visitor; only
     the server talks to the CA.
  3. RELIABILITY / CA LOAD: if the CA's OCSP responder is slow or down,
     browser checks stall or get soft-failed (undermining revocation).
     Stapling offloads this to the server fetching once for everyone,
     reducing CA load and avoiding per-visitor failures.

SSL LABS A+ REQUIREMENTS, mapped to the chapter that introduced each:
  - Full certificate chain served (leaf + intermediates) ......... Chapter 5
  - Only TLS 1.2 + 1.3; no SSL/TLS 1.0/1.1 ...................... Chapter 8
  - Strong cipher suites only (ECDHE + AEAD GCM/ChaCha20) ....... Chapter 8
  - Forward secrecy on all suites (ephemeral key exchange) ...... Chapter 3
  - Adequate key strength (RSA >= 2048-bit or EC 256-bit) ....... Chapter 2/4
  - Valid, in-date, hostname-matching certificate .............. Chapter 4
  - No known vulnerabilities (no RC4/CBC oracles, etc.) ........ Chapter 8/11
  - HSTS enabled with a long max-age (the specific A+ booster) .. Chapter 10

KEY INSIGHT:
  The A+ grade is essentially a CHECKLIST of the entire course. If you
  understand why each item matters, you can both achieve and debug the
  grade rather than blindly copying a config. (CLI equivalent for
  automation/CI: testssl.sh against your host.)