🪪Online Certificate Status Protocol

NEW

Also known as: OCSP

A protocol that provides real-time verification of the revocation status of X.509 certificates via online responders.

DESCRIPTION

OCSP allows clients to query an authoritative responder to check whether a certificate is valid, revoked, or unknown. It reduces reliance on bulky, periodically updated CRLs and can improve revocation freshness. OCSP stapling lets servers include signed responses to reduce latency and privacy concerns. Proper caching, responder availability, and stapling are essential for performance and reliability.

ALTERNATIVE DEFINITIONS

RFC 6960

This specification defines a protocol useful in determining the current status of an end-entity certificate.

Formal, standard definition from the IETF RFC.

Source

Wikipedia

The Online Certificate Status Protocol (OCSP) is an Internet protocol used for obtaining the revocation status of an X.509 digital certificate.

Clarifies purpose and scope of OCSP.

Source

RELATED TERMS

X.509 Public Key Infrastructure TLS Certificate Authority Stapling Server-based Certificate Validation Protocol Trust Store Revocation Checking

COMPETING TERMS

Certificate Revocation List

RELATIONS

• Broader: Protocol

KNOWLEDGE AREAS

Data Security Data Privacy & Compliance Infrastructure

TARGET AUDIENCE

Cybersecurity Engineer Security Architect Chief Information Security Officer Application Administrator IT Manager

EXTERNAL SOURCES

• Wikipedia - Online Certificate Status Protocol
• Cloudflare Learning Center - Overview of OCSP and stapling
• DigiCert - Guide to OCSP stapling configuration

TOP QUESTIONS

Why is OCSP preferred over CRLs?

OCSP provides near real-time revocation status with smaller responses, improving freshness and reducing bandwidth.

Category: Relevancy

What is OCSP stapling and why use it?

Servers include a signed OCSP response in TLS handshakes, reducing client latency and privacy issues.

Category: Best practices

What are common OCSP implementation mistakes?

Not enabling stapling, allowing expired responses, and failing to cache or retry on responder outages.

Category: Mistakes

What is the biggest risk with OCSP responders?

Availability issues can slow connections or block validation; redundancy and caching mitigate risk.

Category: Risks

How does OCSP affect user privacy?

Direct queries can leak browsing patterns; stapling and privacy-sensitive designs reduce exposure.

Category: Opinion

How do browsers treat OCSP today?

Many browsers rely on stapling or CRLSets/OneCRL; behavior varies across vendors.

Category: Overview

What alternatives exist to OCSP?

CRLs and vendor-specific revocation mechanisms (e.g., CRLSets) complement or replace OCSP in some environments.

Category: Alternatives

What is required to enable OCSP stapling on servers?

Configure certificate chains, fetch and cache OCSP responses, and enable stapling in the web server.

Category: Requirements

How should organizations monitor OCSP health?

Track responder availability, response freshness, and TLS handshake metrics across fleets.

Category: Management