bad_certificate_status_response
bad_certificate_status_response (113) is sent when an invalid OCSP response was received via the status_request extension (OCSP stapling). The OCSP response is malformed, the signature does not verify, or the response does not correspond to the presented certificate.
Alert Code
113
Level
Fatal
Standard
RFC 8446
Description
OCSP stapling (RFC 6066) allows the server to include a signed OCSP response in the TLS handshake, proving the certificate has not been revoked without requiring the client to make a separate OCSP request. If the stapled OCSP response is invalid – malformed DER encoding, signature verification failure, wrong certificate serial number, or OCSP response expired – the client sends bad_certificate_status_response. Servers should implement OCSP stapling carefully; an invalid stapled response is worse than no stapling at all.
Common Causes
- –Stapled OCSP response signature does not verify
- –OCSP response is for a different certificate than presented
- –OCSP response has expired (validity window passed)
- –OCSP response DER encoding is malformed