The client asks with the status_request extension (RFC 6066 §8); in TLS 1.3 the server returns the response inside the CertificateEntry extensions of its leaf certificate (RFC 9846 §4.5.1.1). RFC 6961's multi-stapling variant for intermediates saw little use. The Must-Staple certificate extension (RFC 7633) told clients to reject a handshake without a stapled response, but support was limited to Firefox.
Stapling solved privacy but not availability, because servers that failed to refresh responses broke their sites. With public CAs dropping OCSP (Let's Encrypt shut its responders down on 6 August 2025 and stopped accepting Must-Staple orders) stapling disappears for those certificates; servers should not fail to start when no OCSP URL is present.