# What Is OCSP Responder (OCSP server)? Definition and Examples

> An OCSP responder is the CA-operated server that answers OCSP requests with signed good, revoked or unknown statuses for the certificates the CA issued.

Source: https://ssl.sh/glossary/ocsp-responder/
Last updated: 2026-11-10

An OCSP responder is the HTTP service, listed in a certificate's [AIA](https://ssl.sh/glossary/aia/) extension, that answers [OCSP](https://ssl.sh/glossary/ocsp/) queries. Under RFC 6960 a response must be signed either by the issuing CA itself or by a delegated responder certificate that the CA issued directly and that carries the OCSP Signing [extended key usage](https://ssl.sh/glossary/extended-key-usage/). Large CAs pre-generate responses for every unexpired certificate and serve them through CDNs, which works because requests can be sent as HTTP GET and cached until nextUpdate.

## Why it matters
The responder is a service that every relying party may hit, so its availability, latency and freshness directly affect websites. If it is down, most browsers soft-fail, but clients enforcing [Must-Staple](https://ssl.sh/glossary/must-staple/) and servers relying on stapling can break. A responder also sees who checks which certificate, the privacy problem that pushed the industry toward stapling, CRLs and browser-pushed revocation lists. After Ballot SC-063 made OCSP optional, some CAs began retiring responders; Let's Encrypt shut its responders down on 2025-08-06.

## Example
Query a responder directly and print the full signed response:

```bash
openssl ocsp -issuer intermediate.pem -cert cert.pem \
  -url http://ocsp.example.com -resp_text
```

In the output, Responder Id shows who signed the answer; a delegated responder certificate, when included, lists OCSP Signing under Extended Key Usage. This Update and Next Update show how fresh the cached response is.

## Common misconceptions
- **The responder checks a live database for every request.** Most responses are pre-signed and cached, so a new revocation may only appear after the next refresh.
- **Any certificate from the CA can sign OCSP responses.** Only the CA key itself, or a certificate the CA issued directly with the OCSP Signing EKU, is authorized.
- **A responder outage blocks visitors.** Usually not, because clients soft-fail, which is also why an attacker who blocks OCSP can defeat the check.

## Related terms

- [OCSP](https://ssl.sh/zh/glossary/ocsp/): OCSP 是 RFC 6960 定义的在线证书状态协议，客户端可以向 CA 的响应服务器查询某一张证书当前是有效、已吊销还是未知。
- [OCSP Stapling](https://ssl.sh/zh/glossary/ocsp-stapling/): OCSP Stapling 是 TLS 服务器把 CA 签名、带有效期的 OCSP 响应随握手一起发给客户端的机制，浏览器因此不必再自己去问 CA。
- [证书颁发机构](https://ssl.sh/zh/glossary/certificate-authority/): 证书颁发机构（CA）是负责审核申请者、签发数字证书，并把公钥与域名或身份绑定在一起的机构。
- [EKU](https://ssl.sh/zh/glossary/extended-key-usage/): EKU 即扩展密钥用途，是列出证书可用于哪些目的（如 serverAuth 服务器认证、clientAuth 客户端认证、代码签名）的 X.509 扩展。
- [证书吊销](https://ssl.sh/zh/glossary/revocation/): 证书吊销是 CA 在证书到期前宣布其作废的操作，通过 CRL 或 OCSP 对外公布，使客户端不再信任这张证书。
- [CRL](https://ssl.sh/zh/glossary/crl/): CRL 是由 CA 签名并定期重新发布的证书吊销列表，列出它在证书到期前就已吊销的证书序列号。
- [AIA](https://ssl.sh/zh/glossary/aia/): AIA 即颁发机构信息访问，是 X.509 证书扩展，提供签发 CA 证书的下载地址，以及（可选的）该 CA 的 OCSP 服务地址。