pfSense

Not related, but while I was stapling :

    hideCheckbox('ocsp-staple', " 
            <?php 
            $cert_temp = lookup_cert($config['system']['webgui']['ssl-certref']);
            echo (cert_get_ocspstaple($cert_temp['crt']) ? "true" : "false");
            ?>" === "true");

( /usr/local/www/system_advanced_admi.php - line 726 )
What I make of it - consider a certificate with the "must-staple" extension present :
The cert being used by the weggui is extracted : $cert_temp = lookup_cert($config['system']['webgui']['ssl-certref']);
cert_get_ocspstaple($cert_temp['crt']) return boolean 'true' if the certificate has the extension "stapable" (for example, this is an option for acme package : LetEnscrypt will deliver a stapabale certificate)
Thus "echo (cert_get_ocspstaple($cert_temp['crt']) ? "true" : "false");" will be the equivalent of "true"
"true" === "true"
Result : This all boils down to
hideCheckbox('ocsp-staple', "true")
and the checkbox will be hidden ... which means : If you have a certificate that has the "must-staple" extension present, you can not see or use this checkbox.

It's very probable that I didn't understand something, but I tend to say (propose) :

            ?>" === "false");

Or, using my logic : if the cert has no must-staple, then "false" === "false" (= true) and we have a
hideCheckbox('ocsp-staple', "true")
The checkbox will be hidden.

If the cert has the staple option, then
hideCheckbox('ocsp-staple', "false")
and the checkbox will be shown.

I'm using this proposal right now - and can see the checkbox because my cert has the staple option.

Thought ?

When you have a certificate that requires stapling, you can't disable it or it will break GUI access. Hiding the checkbox prevents that from happening easily. The reason it's present at all is so you can manually enable stapling if for some reason the automatic detection fails.

?! You are right. Forgot all about that one.
Zap my staple story : that "true" one is probably right after all.
Thanks for the fast reply and connecting some of my neurons.

Testing is super easy with ACME/LE certs. Edit the cert entry, check the box for stapling, and then renew the cert. It will be reissued with the stapling bits in place, and the GUI will pick it up. Then add an IPv6 name server and watch nginx fail (pre-fix) or work (post-fix)