# What is the Online Certificate Status Protocol (OCSP)?

> The Online Certificate Status Protocol (OCSP) is an internet protocol for checking a digital certificate’s revocation status without downloading a certificate revocation list.

- Canonical URL: https://yellowcube.eu/glossary/online-certificate-status-protocol/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

A client identifies the issuer and certificate serial number to an OCSP responder, which returns a signed status of good, revoked, or unknown with timing information.

The relying application authenticates the response and decides whether it is fresh and applicable. In Transport Layer Security, OCSP stapling lets a server attach a cached, responder-signed response to the handshake, reducing queries and responder dependency.

### Key points

- **Response meaning:** “Revoked” carries revocation data, while “unknown” means the responder does not know the certificate. Under RFC 6960, “good” minimally means no matching certificate is recorded as revoked; it does not prove issuance or validity.
- **Freshness and replay:** Check `thisUpdate`, `nextUpdate`, `producedAt`, local clock policy, and request or response binding. RFC 6960 is a Proposed Standard; RFC 9654 updates its nonce extension, which can reduce replay risk but affects caching.
- **Privacy and availability:** Direct queries can reveal certificate interests to the responder. Stapling can reduce that disclosure and network dependency, but cached responses still require correct validation and timely refresh.
- **Important limitation:** OCSP cannot provide reliable revocation assurance when status is stale, unavailable, untrusted, or ignored. Soft-fail clients may continue after a responder failure, weakening revocation; hard-fail policy can instead turn responder outages into service outages.

### Related terms

[Public key infrastructure (PKI)](<https://yellowcube.eu/glossary/public-key-infrastructure/>) · [Digital certificate](<https://yellowcube.eu/glossary/digital-certificate/>) · [Certificate management](<https://yellowcube.eu/glossary/certificate-management/>) · [Authentication](<https://yellowcube.eu/glossary/authentication/>)

### Sources

[RFC 6960: X.509 Internet Public Key Infrastructure Online Certificate Status Protocol](https://www.rfc-editor.org/info/rfc6960) · [RFC 9654: Online Certificate Status Protocol Nonce Extension](https://www.rfc-editor.org/info/rfc9654) · [RFC 6066: TLS Extensions, including Certificate Status Request](https://www.rfc-editor.org/info/rfc6066)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.