thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Fundamentals & Crypto · Intermediate

Online Certificate Status Protocol (OCSP)

Protocol (RFC 6960) for querying the real-time revocation status of a single certificate.

Definition

An OCSP responder returns good, revoked, or unknown for a certificate serial number. It is more efficient than downloading a full CRL but raises privacy concerns because the CA sees which sites a user visits. The CA/Browser Forum made OCSP optional for public TLS CAs, and Let's Encrypt ended its OCSP service in 2025 in favor of CRLs.

Example

openssl ocsp -issuer chain.pem -cert server.pem -url http://ocsp.example-ca.com queries a certificate's status.

Exam tip

OCSP answers per certificate in real time; stapling removes the client-to-CA privacy leak.

Don't confuse it with

Related terms