Before an end user\u2019s browser connects to a website via HTTPS, it needs to know that the site is using a valid SSL\/TLS certificate. But how can their client or your web server verify whether a server\u2019s SSL\/TLS certificate is valid and hasn\u2019t been revoked for one reason or another? There are two main types of certificate revocation status checks that are used by certificate authorities (CAs) \u2014 certificate revocation lists (CRLs) and the online certificate status protocol, or OCSP. Of course, there are various enhancements to both of these revocation status check mechanisms. Unfortunately, we can\u2019t cover all of them, so we\u2019ll just touch on a select few in this article.<\/p>\n\n\n\n
But what exactly is OCSP? How does it differ from certificate revocation lists (CRLs), OCSP stapling, and OCSP must-staple? What role does the OCSP protocol play in verifying a certificate\u2019s revocation status? And where do we go from here to improve the revocation checking process?<\/p>\n\n\n\n
Let\u2019s hash it out.<\/span><\/p>\n\n\n\n The online certificate status protocol is an internet protocol that\u2019s described in the Internet Engineering Task Force\u2019s (IETF) RFC 6960<\/a>. It\u2019s one method that web clients (browsers) use to determine the revocation status of a web server\u2019s X.509 digital certificate when attempting to connect to a website. So, basically, the OCSP protocol is a real-time check of a website certificate\u2019s revocation status.<\/strong> It\u2019s an alternative to using CRLs.<\/p>\n\n\n\n To put it simply: OCSP responder = OCSP server<\/strong>. People frequently use the terms \u201cOCSP servers\u201d and \u201cOCSP responders\u201d interchangeably because of their functions. An OCSP server belongs to the CA who issued the digital certificate. It uses the certificate\u2019s serial number, which the client provides in its OCSP request, to look up its revocation status and \u201crespond\u201d with the status. (Hence its other name \u201cOCSP responder.\u201d)<\/p>\n\n\n\n Commercial digital certificates, which includes SSL\/TLS website security certificates<\/a>, are issued by trusted third parties known as certificate authorities to identify and authenticate individuals, organizations, or other entities. So, when a CA revokes a certificate<\/a>, it means that they\u2019re saying that the certificate is no longer valid for one reason or another and that it can\u2019t be trusted. However, the CA needs a way to communicate that certificate invalidation info to users\u2019 clients and to web servers.<\/p>\n\n\n\n This is where certificate revocation lists (CRLS) and the open certificate status protocol come into play.<\/p>\n\n\nWhat Is the Online Certificate Status Protocol?<\/h2>\n\n\n\n
What\u2019s the Role of an OCSP Responder?<\/h3>\n\n\n\n