OCSP (Online Certificate Status Protocol)
OCSP is a protocol for checking whether a TLS certificate has been revoked in real-time. Instead of downloading entire CRL lists, clients query the CA's OCSP responder for a single certificate's status (good/revoked/unknown). OCSP stapling lets the server fetch and cache the response, avoiding client-side privacy leaks and latency.
Definition
OCSP enables real-time revocation checking by querying a CA's OCSP responder with the certificate serial number. The responder returns a signed response: good (not revoked), revoked (compromised/superseded), or unknown. OCSP has privacy issues – the CA sees which sites the client visits. OCSP stapling (RFC 6066) solves this: the server periodically fetches its own OCSP response and includes (staples) it in the TLS handshake. The client verifies the stapled response's CA signature without contacting the CA directly. Must-Staple (RFC 7633) is a certificate extension requiring the server to always staple a valid response – if omitted, the client must reject the connection. Without Must-Staple, clients soft-fail (accept when OCSP is unavailable), making revocation unreliable.
Examples
- –openssl s_client -connect host:443 -status (shows OCSP stapling response)
- –Nginx: ssl_stapling on; ssl_stapling_verify on; resolver 8.8.8.8;
- –openssl ocsp -issuer chain.pem -cert server.pem -url http://ocsp.ca.com
Related Protocols
Related Terms
Certificate Authority (CA)
A Certificate Authority issues and signs TLS certificates that browsers and operating systems trust. CAs verify domain ownership (DV), organization identity (OV), or extended validation (EV) before signing. The CA system relies on ~150 root certificates pre-installed in trust stores. Let's Encrypt automated DV issuance, issuing 400M+ active certificates.
CRL (Certificate Revocation List)
A CRL is a signed list of revoked certificate serial numbers published periodically by a CA. Clients download CRLs to check if a presented certificate has been revoked. CRLs are large (megabytes), updated infrequently (hours to days), and rarely checked by browsers. OCSP and short-lived certificates are the modern replacements.