OCSP (Online Certificate Status Protocol)

OCSP (Online Certificate Status Protocol) is a request/response protocol, specified in RFC 6960, for checking the revocation status of one certificate at a time. The client sends the certificate's serial number plus hashes of the issuer's name and key to the responder URL listed in the certificate's AIA extension, and receives a signed answer: good, revoked or unknown. Each response carries thisUpdate and nextUpdate times and can be cached until it expires.

Why it matters

OCSP was designed as a lighter alternative to downloading a full CRL, but it has well-known weaknesses. Every lookup tells the CA which site the user is visiting, it adds latency to the first connection, and most clients soft-fail: if the responder is unreachable, the certificate is accepted anyway. Chrome has long relied on its own pushed revocation lists instead of live OCSP queries. Since CA/Browser Forum Ballot SC-063 (effective 2024-03-15), OCSP is optional for publicly trusted CAs while CRLs are mandatory, and Let's Encrypt shut its OCSP responders down on 2025-08-06. Servers that still have OCSP available should use OCSP stapling.

Example

Find the responder URL, then query it with OpenSSL:

openssl x509 -in cert.pem -noout -ocsp_uri
openssl ocsp -issuer intermediate.pem -cert cert.pem \
  -url http://ocsp.example.com -resp_text

A healthy answer ends with cert.pem: good followed by This Update and Next Update times. If the first command prints nothing, the certificate has no OCSP URL, which is normal for CAs that publish only CRLs.

Common misconceptions

• Browsers check OCSP on every connection. Chrome does not perform live OCSP checks for ordinary certificates, and clients that do usually soft-fail when the responder cannot be reached.
• Every certificate has an OCSP URL. Since SC-063 a CA may publish only CRLs; Let's Encrypt certificates issued since 2025-05-07 contain no OCSP URL.
• "Unknown" means revoked. It only means the responder has no information about that serial number, often because the wrong issuer or responder was queried.