What Is OCSP?

At a glance

A certificate can be revoked before expiry after key compromise or misissuance. OCSP and OCSP Stapling provide clients with revocation-status signals.

Why an unexpired certificate still needs a status check

A certificate may be revoked before its expiry date following private-key compromise, misissuance or a change of subject. Online Certificate Status Protocol lets a client ask a CA's responder about a specific certificate. The signed response reports good, revoked or unknown and has a validity window.

OCSP distributes revocation status; it does not revalidate the domain or assess website content. Direct client queries add latency and reveal browsing-related information to the responder. Network blocking or responder outages force clients to balance security and availability through soft-fail or hard-fail policies.

How OCSP Stapling attaches status to a handshake

• The server periodically obtains a signed OCSP response from the CA and staples it to the TLS handshake, reducing separate client requests to the CA.
• The client checks that the response applies to the certificate, has a valid signature and is within its thisUpdate and nextUpdate window.
• Refresh failures may cause stale responses or missing stapling. Whether the connection is blocked depends on certificate extensions and client policy.
• Must-Staple can require clients to expect a stapled response. Reliable refresh and monitoring are essential, or responder problems may become website outages.

Revocation checking is not a single switch

Browsers may combine OCSP, CRLs, compressed revocation lists, vendor updates and their own risk policies. Clients differ in handling network failures, unknown responses and short-lived certificates. A handshake without stapling does not establish that all revocation protection is absent.

Operations should cover key-compromise response, successful CA revocation, consistency across edge nodes and stapling refresh times. Expiry monitoring alone cannot detect early revocation.

Practical use and interpretation

A signed OCSP response supplies a certificate status and response validity interval. Good means the responder has not marked the certificate revoked in that window, not that the website is certified safe. An unknown certificate status is also different from a failed query.

When stapling is not observed, the supported conclusion is that the connection supplied no confirmed stapled response. Clients may use other mechanisms; this is not proof that revocation was never checked.

Points to consider

A missing OCSP response does not necessarily indicate a certificate problem: client failure policy, caches and other revocation mechanisms also matter.

Frequently asked questions

Does OCSP good prove a certificate is completely safe?

It only means the responder has not marked it revoked in the relevant time window. It does not assess newly compromised keys, content or application vulnerabilities.

Does missing OCSP Stapling cause a browser warning?

Not necessarily. Client behavior, certificate settings and Must-Staple matter. The client may query directly or use other revocation mechanisms.

How do OCSP and CRLs differ?

OCSP supplies an online response for a certificate; a CRL publishes a list of revoked certificates. Clients may combine several approaches.