OCSP Status

OCSP (Online Certificate Status Protocol) Status provides real-time information about whether an SSL/TLS certificate has been revoked by its issuing Certificate Authority. Unlike Certificate Revocation Lists (CRLs) which are downloaded periodically, OCSP allows clients to query the CA''s OCSP responder in real-time to check the current status of a specific certificate.

General

What is OCSP Status?

OCSP (Online Certificate Status Protocol) Status provides real-time information about whether an SSL/TLS certificate has been revoked by its issuing Certificate Authority. Unlike Certificate Revocation Lists (CRLs) which are downloaded periodically, OCSP allows clients to query the CA's OCSP responder in real-time to check the current status of a specific certificate.

OCSP Response Types

OCSP responders return one of three possible status responses:

  • Good: Certificate is valid and has not been revoked
  • Revoked: Certificate has been revoked by the CA, with revocation reason and date
  • Unknown: OCSP responder cannot determine the certificate's status
  • No Response: OCSP responder is unavailable (soft-fail scenario)

Implementation and Security Considerations

OCSP checking can impact connection performance since it requires an additional network request during the TLS handshake. To address this, OCSP Stapling was developed, where the server periodically retrieves its own OCSP response and presents it to clients during the handshake. This eliminates the client's need to contact the OCSP responder directly, improving performance and privacy. However, OCSP checking is not universally implemented due to reliability concerns - if the OCSP responder is unavailable, browsers typically employ a 'soft-fail' approach and allow the connection to proceed. Understanding OCSP status helps administrators ensure their certificates are properly validated and maintain user trust.

Where You'll See This Term

This term commonly appears in:

  • SSL certificate details pages
  • Certificate Authority validation processes
  • SSL configuration documentation
  • Security audit reports
  • Certificate management interfaces

Related SSL Terms

Supported SSL/TLS Protocols

Supported SSL/TLS Protocols represent the complete list of protocol versions that a server is configured to accept and negotiate with connecting clients. This configuration determines which clients can successfully establish secure connections and influences both security posture and compatibility with older systems.

General

Certificate Expires On

The Certificate Expiration Date indicates the exact timestamp when an SSL/TLS certificate will cease to be valid and trusted by browsers and other client applications. After this date, the certificate enters an expired state and will trigger security warnings, potentially blocking access to the secured website or service.

General

Last Checked

The Last Checked timestamp indicates when the SSL/TLS certificate''s status and properties were most recently verified by the monitoring system. This timestamp is crucial for understanding the freshness of certificate data and ensuring that any changes or issues with the certificate are detected promptly.

General

Current SSL/TLS Protocol

The Current SSL/TLS Protocol refers to the specific version of the SSL/TLS protocol that was negotiated and is actively being used for the secure connection. This represents the agreed-upon protocol version between the client and server after the TLS handshake process, which may differ from the maximum protocol version supported by either party.

General

Certificate Issued On

The Certificate Issue Date represents the exact timestamp when the Certificate Authority (CA) digitally signed and issued the SSL/TLS certificate. This date marks the beginning of the certificate''s validity period and indicates when the certificate became active and ready for use in securing communications.

General

End Entity Certificate

An End Entity Certificate, also known as a server certificate or leaf certificate, is the final certificate in the SSL/TLS certificate chain that is directly bound to the specific server, domain, or service being secured. This certificate contains the public key used for encrypting communications and the identity information that browsers and other clients use to verify they are connecting to the intended server.

General

Need Help with SSL Certificate Management?

Understanding SSL terminology is just the beginning. Chill SSL helps you monitor and manage your SSL certificates to prevent expiration and security issues.

Start Monitoring SSL Certificates