CyberGlossary

Network Security

OCSP (Online Certificate Status Protocol)

Also known as: Online Certificate Status Protocol, OCSP stapling

Definition

An HTTP-based protocol that lets a client query a CA's responder in real time to determine whether a specific X.509 certificate is valid, revoked or unknown.

OCSP, defined in RFC 6960, replaces large, slowly-refreshed CRLs with a real-time lookup. The client sends a signed request containing the serial number of the certificate to the OCSP responder URL listed in the certificate's Authority Information Access extension. The responder returns a signed status (good, revoked, or unknown) and the relying party trusts the result if it can validate the responder's signature. OCSP stapling lets the TLS server fetch and cache the response itself and present it during the handshake, removing privacy and performance issues of clients querying CAs. Combined with must-staple, OCSP makes revocation reliably enforceable in TLS.

Examples

  • A browser issuing an OCSP request to verify the certificate of an online banking site.
  • An HTTPS server with OCSP stapling enabled to deliver a fresh signed status during each TLS handshake.

Related terms