There are two problems with OCSP stapling: * It requires some configuration on the server side. So it probably won't be enabled for the great majority of sites

There are two problems with OCSP stapling: * It requires some configuration on the server side. So it probably won't be enabled for the great majority of sites until some future generation of upgrades enables it by default. * If a MitM presents his evil server to the client, he's just going to opt out of sending the stapled OCSP response. So the browser's back in exactly the same situation where he has to block for 1 whole extra second to do traditional OCSP (and has the same hard decision to make about what to tell the user if it fails). EDIT: Which is not to say that I don't think it's still a great idea. It just would have worked a lot better if it had been the original OCSP mechanism.