What is OCSP?

The Online Certificate Status Protocol (OCSP) is a real-time method for checking whether a digital certificate has been revoked. Instead of downloading a full revocation list, a client sends a single query to an OCSP responder and gets back an immediate Good, Revoked, or Unknown answer.

Key takeaways

• OCSP checks certificate revocation status in real time, not from a stored list.
• A client queries an OCSP responder and gets back Good, Revoked, or Unknown.
• OCSP stapling lets a server present a cached, signed response at handshake time.
• Versa TLS decryption profiles can enforce OCSP checks before trusting a certificate.
• Versa Director can bring an IPsec tunnel down when an OCSP response is Unknown.

On this page: Why it matters · How it works · Types · OCSP & Versa · FAQ

Why is OCSP important?

Digital certificates get revoked – a private key leaks, a domain changes hands, a CA makes a mistake – and every system that trusts the certificate needs to find out quickly. CRLs publish every revoked certificate from a CA, but the lists grow large and clients may cache stale copies between updates, leaving a window where a revoked certificate still looks valid.

OCSP closes that window. A relying party queries the issuing CA, or a delegated responder, for one specific certificate’s status and gets back a signed, timely answer – milliseconds rather than the minutes a CRL download can take. That matters most where trust decisions happen automatically and at scale: TLS handshakes, VPN and IPsec certificate authentication, and any workflow where a revoked credential must be rejected immediately.

What is OCSP?

OCSP is defined in RFC 6960 as a request-response protocol carried over HTTP. The requester builds a request containing the certificate’s serial number and issuer, hashed rather than sent in the clear, and posts it to the responder’s URL. The responder – the CA itself or a delegated third party – returns a response signed with its own key, so the client can verify the answer’s source.

The response carries one of three statuses: Good (not revoked, as far as the responder knows), Revoked (with a reason and time), or Unknown (no record of the certificate – not the same as vouching for it). Responses also carry validity windows, so clients can cache an answer instead of querying on every connection, trading responder load against how current the data is.

Types of OCSP

Two delivery models cover most deployments. Direct OCSP checking has the client – a browser, a VPN gateway, a firewall – query the responder at connection time; simple, but it adds a round trip and depends on responder reachability. OCSP stapling flips that: the server fetches a signed response ahead of time and attaches (“staples”) it to the TLS handshake, so the client validates revocation status without contacting the responder. Stapling cuts responder load and removes a privacy leak, since responders otherwise learn which sites a client visits.

Caching further shapes behavior: responders and clients both honor a response validity period, and devices that enforce OCSP can poll for fresh status on a set interval rather than every transaction. How a device handles an inconclusive answer – Unknown or a timeout – is a policy choice, not part of the protocol, which is why implementations expose an explicit setting for it.

OCSP & Versa

VOS devices support OCSP in certificate server configuration in Director view, in the NGFW-focused certificate server workflow, and for a global, organization-independent CA configured through a common certificate authority. Each server’s OCSP tab sets the responder URL, the hash algorithm for requests, and a response cache period (up to 168 hours) so the device does not re-query on every use. A monitor interval lets VOS poll responder status on a schedule, and toggles control request signing and signature verification.

The setting with the most operational weight is On Response Unknown: administrators choose whether an inconclusive OCSP answer brings an associated IPsec tunnel down or leaves it up, trading availability against certificate assurance. OCSP verification also gates VOS’s TLS decryption profiles, sharing a cache with CRL checking, which VOS falls back to only when OCSP cannot validate a certificate.

Frequently asked questions

What is the difference between OCSP and a CRL?

A CRL is a periodically published list of every certificate a CA has revoked; clients download the whole list and check it locally, so it can go stale between updates. OCSP is a live, per-certificate query, returning a signed, timely answer without fetching a full list.

What does an OCSP response of “Unknown” mean?

Unknown means the responder has no record of the certificate – not that the certificate is valid. It can result from a misconfigured responder, a certificate issued by a different CA than the one queried, or a database update delay.

What is OCSP stapling?

OCSP stapling has the server, not the client, fetch a signed response ahead of time and attach it to the TLS handshake. It avoids a client-to-responder round trip, keeps browsing activity private, and keeps working if the responder is briefly unreachable.

Does OCSP checking slow down TLS handshakes?

Direct OCSP checking adds one round trip per validation unless cached, adding latency if the responder is slow. OCSP stapling removes that cost entirely, since the server supplies an already-signed response fetched in advance.

What happens if an OCSP responder is unreachable?

Behavior depends on policy, not the protocol. Some systems fail open, treating an unreachable responder like Unknown and keeping the tunnel up; others fail closed and block it. Versa administrators set this per certificate server.

More on OCSP

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about OCSP, these are worth looking at next.