Home/ Glossary/ Online Certificate Status Protocol

Online Certificate Status Protocol (OCSP)

Security Glossary - SSL/TLS

Definition: OCSP is a protocol for querying a certificate authority about the revocation status of a certificate. A response can identify the serial number as good, revoked, or unknown. Deployment has declined in parts of the public Web PKI because of privacy, reliability, and ecosystem tradeoffs.

Why OCSP Is Important

Certificate revocation is the mechanism for invalidating compromised certificates before they expire. If a server's private key is stolen, the certificate must be revoked so browsers stop trusting it. OCSP provides a way for browsers to check revocation status without downloading large CRL files.

However, traditional OCSP has privacy and reliability concerns. Each time a browser connects to a site, it contacts the CA's OCSP responder, revealing which sites the user visits. If the OCSP responder is slow or down, the browser must decide whether to block the connection (hard-fail, which hurts availability) or proceed without checking (soft-fail, which defeats the purpose of revocation checking).

Browser revocation behavior is implementation-specific and can use CRLs, vendor-distributed revocation data, OCSP, stapled responses, or combinations. Let's Encrypt removed OCSP URLs from new certificates in May 2025 and shut down its OCSP service in August 2025; it now publishes revocation information through CRLs.

Testing Your Configuration

Inspect the certificate for its current revocation-information mechanisms and follow the issuing CA's guidance. Do not require an OCSP URL or stapled response for a certificate whose CA has moved to CRLs. DomainOptic does not provide complete client-specific revocation validation.

Check SSL Certificate

Common Questions About OCSP

What is the difference between OCSP and CRL?
OCSP returns a signed status for an individual certificate, while a CRL publishes a signed collection of revoked serial numbers. Privacy, freshness, bandwidth, caching, and availability tradeoffs differ.
Do browsers actually check OCSP?
Behavior varies by browser, platform, CA, certificate, and policy. Some clients use vendor-distributed revocation data or CRLs instead of direct OCSP. Test the clients you support and follow the CA's current revocation design.

See Also

OCSP Stapling Certificate Revocation List SSL/TLS Certificate Certificate Authority Certificate Chain of Trust
Disclaimer: DomainOptic provides automated informational scans only. Results do not constitute professional security advice, compliance certification, or a guarantee of security. Always verify findings independently.