more information about OCSP stapling and certificate revocation: https://www.grc.com/revocation/ocsp-must-staple.htm Pretty much all of or webs do miss this. I'm not sure if it's possible to implement this with CDN...