As of 2017-10, No.
Dovecot does not have any OCSP support whatsoever, as of 2016 was considering the feature for a future release, no work has been done on that since.
Postfix does not have any OCSP support whatsoever, and as of 2017 is not planning to ever to ever implement such feature.
Exim can provide clients with an OCSP response, yet acquiring such is yet left as an exercise to the admin.
The main arguments against adding such support are:
- Security features should be simple so they have more benefit than added risks. OCSP is complex. Short certificate validity is simple and mitigates the same issue.
- The Chicken-Egg problem of OCSP support in servers being entirely useless until MUAs add such support.
This does not hinder the usage of
must-staple certificates in web servers. Just have the option enabled on your web server certificate (e.g.
www.example.com) and disabled on your mail server certificate (e.g.
Warning: If support eventually is enabled in your desired servers, do not also expect them to validate the OCSP resonses they send (e.g., nginx has an optional, default-off feature
ssl_stapling_verify for such purposes).
Speaking from experience, OCSP responders occasionally return the weirdest things, that (if your server unconditionally forwards them unchecked) will disconnect your clients MUAs, when in fact the second latest response would have been fine.