ocsp stapling readme
@@ -36,6 +36,18 @@ After recent tests we realized that TLS performance is lower than we would like.
To use conscrypt or wildfly, you will need to add the appropriate jars to your class path and create an SSL context manually. This context can be passed to the Options used when creating a connection. The NATSAutoBench example provides a conscrypt flag which can be used to try out the library, manually including the jar is required.
+### OCSP Stapling
+Our server now supports OCSP stapling. To enable Java to automatically check the stapling
+when making TLS connections, you must set system properties. This can be done from your
+command line or from your Java code:
+
+```
+System.setProperty("jdk.tls.client.enableStatusRequestExtension", "true");
+System.setProperty("com.sun.net.ssl.checkRevocation", "true");
+```
+
+For more information, see the Oracle Java documentation page on [Client-Driven OCSP and OCSP Stapling](https://docs.oracle.com/javase/8/docs/technotes/guides/security/jsse/ocsp.html)
+
### UTF-8 Subjects
The client protocol spec doesn't explicitly state the encoding on subjects. Some clients use ASCII and some use UTF-8 which matches ASCII for a-Z and 0-9. Until 2.1.2 the 2.0+ version of the Java client used ASCII for performance reasons. As of 2.1.2 you can choose to support UTF-8 subjects via the Options. Keep in mind that there is a small performance penalty for UTF-8 encoding and decoding in benchmarks, but depending on your application this cost may be negligible. Also, keep in mind that not all clients support UTF-8 and test accordingly.
