4 ms·
Without OCSP stapling, every time someone connects to your server via HTTPS their client will check with the CA's OCSP server to verify that the certificate is
by noinsight 11y ago
Without OCSP stapling, every time someone connects to your server via HTTPS their client will check with the CA's OCSP server to verify that the certificate is still valid. They maintain CRL's for certificates etc. For DV certificates less so and EV certificates more so, the CA also verifies your information before issuing certificates.
This infrastructure is not free. But yes, technically CA's could issue certificates for absolutely everyone for near-zero cost and they would be just as good as the ones that cost more.