# What Is OCSP (Online Certificate Status Protocol)?

> OCSP is a protocol, defined in RFC 6960, that lets a client ask a CA's responder whether a single certificate is currently good, revoked or unknown.

Source: https://ssl.sh/glossary/ocsp/
Last updated: 2026-11-10

OCSP (Online Certificate Status Protocol) is a request/response protocol, specified in [RFC 6960](https://www.rfc-editor.org/rfc/rfc6960), for checking the revocation status of one certificate at a time. The client sends the certificate's serial number plus hashes of the issuer's name and key to the responder URL listed in the certificate's [AIA](https://ssl.sh/glossary/aia/) extension, and receives a signed answer: good, revoked or unknown. Each response carries thisUpdate and nextUpdate times and can be cached until it expires.

## Why it matters
OCSP was designed as a lighter alternative to downloading a full [CRL](https://ssl.sh/glossary/crl/), but it has well-known weaknesses. Every lookup tells the CA which site the user is visiting, it adds latency to the first connection, and most clients soft-fail: if the responder is unreachable, the certificate is accepted anyway. Chrome has long relied on its own pushed revocation lists instead of live OCSP queries. Since CA/Browser Forum Ballot SC-063 (effective 2024-03-15), OCSP is optional for publicly trusted CAs while CRLs are mandatory, and Let's Encrypt shut its OCSP responders down on 2025-08-06. Servers that still have OCSP available should use [OCSP stapling](https://ssl.sh/glossary/ocsp-stapling/).

## Example
Find the responder URL, then query it with OpenSSL:

```bash
openssl x509 -in cert.pem -noout -ocsp_uri
openssl ocsp -issuer intermediate.pem -cert cert.pem \
  -url http://ocsp.example.com -resp_text
```

A healthy answer ends with `cert.pem: good` followed by This Update and Next Update times. If the first command prints nothing, the certificate has no OCSP URL, which is normal for CAs that publish only CRLs.

## Common misconceptions
- **Browsers check OCSP on every connection.** Chrome does not perform live OCSP checks for ordinary certificates, and clients that do usually soft-fail when the responder cannot be reached.
- **Every certificate has an OCSP URL.** Since SC-063 a CA may publish only CRLs; Let's Encrypt certificates issued since 2025-05-07 contain no OCSP URL.
- **"Unknown" means revoked.** It only means the responder has no information about that serial number, often because the wrong issuer or responder was queried.

## Related terms

- [OCSP Stapling](https://ssl.sh/zh/glossary/ocsp-stapling/): OCSP Stapling 是 TLS 服务器把 CA 签名、带有效期的 OCSP 响应随握手一起发给客户端的机制，浏览器因此不必再自己去问 CA。
- [OCSP Responder](https://ssl.sh/zh/glossary/ocsp-responder/): OCSP Responder 是 CA 运营的 HTTP 服务，负责对 OCSP 查询返回带签名的有效、已吊销或未知状态。
- [CRL](https://ssl.sh/zh/glossary/crl/): CRL 是由 CA 签名并定期重新发布的证书吊销列表，列出它在证书到期前就已吊销的证书序列号。
- [证书吊销](https://ssl.sh/zh/glossary/revocation/): 证书吊销是 CA 在证书到期前宣布其作废的操作，通过 CRL 或 OCSP 对外公布，使客户端不再信任这张证书。
- [OCSP Must-Staple](https://ssl.sh/zh/glossary/must-staple/): OCSP Must-Staple 是一种证书扩展，要求客户端在服务器没有随握手提供有效 OCSP 响应时直接拒绝该证书。
- [CRLite](https://ssl.sh/zh/glossary/crlite/): CRLite 是 Mozilla 为 Firefox 打造的压缩吊销数据集，浏览器无需联系 CA，就能在本地判断公开记录的证书是否已被吊销。
- [AIA](https://ssl.sh/zh/glossary/aia/): AIA 即颁发机构信息访问，是 X.509 证书扩展，提供签发 CA 证书的下载地址，以及（可选的）该 CA 的 OCSP 服务地址。