The Online Certificate Status Protocol (OCSP) lets a client ask a certificate authority's responder whether one specific certificate is still valid. The responder answers with a signed "good", "revoked" or "unknown" status, which is far smaller than a full revocation list.
Why it matters
OCSP was designed as a lighter alternative to CRLs. It has real downsides, though. Each check adds a network round trip, and the CA learns which sites a visitor is opening. Browsers also tend to "soft fail", meaning they accept the certificate if the responder cannot be reached, which weakens the protection. Those problems led to OCSP stapling, and more recently some CAs, including Let's Encrypt, have ended their OCSP service entirely.
Example
The responder URL lives in the certificate's Authority Information Access field. Query it manually:
openssl x509 -in cert.pem -noout -ocsp_uri
openssl ocsp -issuer chain.pem -cert cert.pem -url http://ocsp.example-ca.test -resp_textThe output includes Cert Status: good plus the validity window of the response.
Common mistakes
- Enabling stapling in your server config when your CA no longer runs an OCSP responder.
- Blocking outbound traffic to the responder, which makes stapling fail silently.
- Believing OCSP makes revoked certificates unusable. Soft-fail clients can still connect.
Related
Get notified when this term updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.