MOZILLA_PKIX_ERROR_REQUIRED_TLS_FEATURE_MISSING
MOZILLA_PKIX_ERROR_REQUIRED_TLS_FEATURE_MISSING — cert carries the tlsfeature extension (RFC 7633) with OCSP Must-Staple flag, but the server is not stapling an OCSP response in the TLS handshake. Fix: enable OCSP stapling on the server, or reissue cert without Must-Staple. nginx: ssl_stapling on + DNS resolver.
Below: causes, fixes, FAQ.
Common Causes
- Cert issued with Must-Staple flag but nginx/Apache stapling disabled
- OCSP responder unreachable (CA outage)
- nginx ssl_stapling_verify on — fails → no staple
- Resolver missing —
resolver 8.8.8.8 1.1.1.1required - Firewall blocks outgoing HTTP to OCSP endpoint
Step-by-Step Fix
- nginx:
ssl_stapling on; ssl_stapling_verify on; resolver 1.1.1.1 valid=300s; ssl_trusted_certificate chain.pem;(for stapling verify)- Reload nginx, wait ~5 min for prefetch
- Verify:
openssl s_client -connect host:443 -status→ "OCSP Response Data" - Or reissue cert without Must-Staple (most CAs allow)
Related SSL Errors
Why teams trust us
How it works
Enter domain
TLS chain verified
Expiry date & vulnerabilities
What Does the SSL Check Cover?
SSL/TLS is the encryption protocol that protects data between the browser and server. Our tool analyzes the certificate, chain of trust, TLS version, and knownvulnerabilities.
Certificate Details
Issuer, validity period, signature algorithm, covered domains (SAN), and validation type (DV/OV/EV).
Chain of Trust
Full chain verification: from leaf certificate through intermediates to root CA.
TLS Analysis
Protocol version (TLS 1.2/1.3), cipher suites, Perfect Forward Secrecy (PFS) support.
Expiry Alerts
Set up a monitor — get Telegram and email alerts 30/14/7 days before expiration.
DV vs OV vs EV Certificates
- Confirms domain ownership only
- Issued in minutes automatically
- Free via Let's Encrypt
- Suitable for most websites
- Most common certificate type
- Organization (OV) or Extended Validation (EV)
- Issued in 1-5 business days
- Costs $50 to $500/year
- For finance, e-commerce, government sites
- Increases user trust
Who uses this
DevOps
SSL certificate monitoring
Security
TLS config audit
SEO
HTTPS as ranking factor
E-commerce
customer trust
Common Mistakes
www and subdomains.Best Practices
Strict-Transport-Security header forces browsers to always use HTTPS.Get more with a free account
SSL certificate monitoring, check history and alerts 30 days before expiry.
Sign up freeLearn more
Frequently Asked Questions
What is Must-Staple?
A cert extension telling the client: "I expect a stapled OCSP response in the handshake". Missing → cert invalid, even if OCSP responder times out.
Does my CA set Must-Staple?
Let's Encrypt — no by default. DigiCert — optional. Became rare 2024+ because CA-level OCSP turned reliable.
Always enable stapling?
Yes, good practice. Reduces RTT, improves privacy (client does not contact CA directly).
How to verify?
<a href="/en/ssl">Enterno SSL</a> shows OCSP stapling status in report.