DH Keys DSA Keys EC Keys Firefox General Google Chrome IE (Internet Explorer) Intermediate CA Java VM JDK Keytool Microsoft CertUtil Mozilla CertUtil OpenSSL Other Portecle Publishers Revoked Certificates Root CA RSA Keys Tools Tutorial What Is Windows

What Is OCSP (Online Certificate Status Protocol)

Q

What is OCSP (Online Certificate Status Protocol)?

✍: FYIcenter.com

A

OCSP (Online Certificate Status Protocol) is an Internet protocol that allows client systems to communicate with the CA (Certificate Authority) of an X.509 digital certificate to verify the status of the certificate.

When a client system receives an X.509 digital certificate from a server, the client system should first make sure the certificate has not been revoked by the CA.

This can be done by sending an OCSP request to CA's OCSP server. The request contains the certificate's identification. The CA's OCSP server will return the current revocation status of the certificate. If the status says revoked, the certificate should be rejected.

Here is a diagram showing how a client system receives a server certificate and verifies its status using OCSP (source: venafi.com).
Certificate Status Check using OCSP

 

⇒ Find OCSP Server URL of Certificate CA

⇐ OCSP (Online Certificate Status Protocol)

⇑ OCSP (Online Certificate Status Protocol)

⇑⇑ Revoked Certificates - CRL and OCSP

2016-08-16, 3182👍, 0💬

DH Keys DSA Keys EC Keys Firefox General Google Chrome IE (Internet Explorer) Intermediate CA Java VM JDK Keytool Microsoft CertUtil Mozilla CertUtil OpenSSL Other Portecle Publishers Revoked Certificates Root CA RSA Keys Tools Tutorial What Is Windows