OCSP

OCSP explained: the real-time protocol for checking certificate revocation status, how it differs from CRL, and what OCSP stapling does.

OCSP (Online Certificate Status Protocol, RFC 6960) is a protocol for checking whether a certificate is still valid, closer to real time than downloading a full list. Instead of downloading an entire CRL and searching it locally, a client sends the certificate's serial number to an OCSP responder operated by (or on behalf of) the issuing certificate authority, which replies with a signed status: good, revoked, or unknown. The response can be pre-produced and cached until its stated nextUpdate time, so it is not necessarily current to the second.

Because each check is small, OCSP is the workhorse of signature validation software confirming that an X.509 certificate has not been revoked, usually alongside CRLs rather than instead of them. Public web PKI has been moving away from OCSP: the CA/Browser Forum has made it optional for public TLS CAs while requiring CRLs, and some major CAs have dropped it entirely - Let's Encrypt shut down its OCSP responders in August 2025 and Google Trust Services stopped supporting OCSP the same year - while Chrome and Firefox check their own aggregated lists (CRLSets, CRLite) instead of querying a responder live. A variant called OCSP stapling lets a server fetch and cache the signed response itself and present it directly to clients, which reduces load on the responder and avoids a separate lookup by every visitor. For the revocation mechanism used for wallet-issued attestations rather than X.509 certificates, see status list.