Online Certificate Status Protocol

As explained in Real-World Cryptography

OCSP is a protocol for querying an authority about the current revocation status of a digital certificate.

A certificate can become dangerous after its private key is compromised. OCSP lets a browser or other client query a certificate authority through a simple web interface to learn whether the certificate has been revoked. section 9.3

OCSP improves on certificate revocation lists, but introduces practical tradeoffs:

• It avoids downloading and repeatedly checking potentially large revocation lists. section 9.3
• It requires certificate authorities to operate highly available status services. section 9.3
• It can reveal web traffic information to the authority, while timeouts may be ignored to preserve the user experience. section 9.3

OCSP stapling

A website can query the authority for a signed certificate-status response and attach, or “staple,” that response during the TLS handshake, reducing direct client queries to the authority. section 9.3

Figure 9.9 Certificate revocation on the web has had three popular solutions: Certificate Revocation Lists (CRLs), Online Certificate Status Protocol (OCSP), and OCSP stapling.

Compare certificate revocation lists, direct OCSP queries, and OCSP stapling as three approaches to checking certificate status. section 9.3

How Real-World Cryptography covers it

How deep it goes

Defines the query model and explains availability, privacy, timeout, and stapling tradeoffs without implementation detail.

Examples

Uses authority status queries, large revocation lists, timeout behavior, and stapled signed responses as concrete examples.

What you can do after

Evaluate certificate-status mechanisms and recognize why OCSP stapling can reduce privacy and availability problems.

How it connects

Connects certificate revocation with certificate authorities, certificate revocation lists, OCSP stapling, and TLS handshakes.

liveBookmanning.com

Read Real-World Cryptography on liveBook Get the book at manning.com

Related concepts

• OCSP staplingused by · OCSP stapling is a TLS technique in which a server supplies a certificate authority's signed certificate-status response during the handshake.
• certificate revocation listalternative to · A certificate revocation list is a digitally signed list published by a certificate authority identifying digital certificates revoked before expiration.

This explainer was generated by Manning's knowledge graph from the text of Real-World Cryptography. The section links point to the parts of the book it draws on.