What is OCSP?
Online Certificate Status Protocol — a live check of whether a certificate has been revoked.
Written by the SkyQon engineering team · Last verified 4 August 2026
Why it matters
A certificate can be revoked before it expires — after a key compromise, or when a service is decommissioned. OCSP was the mechanism for asking a certificate authority, in real time, whether one specific certificate is still valid.
The standard
RFC 6960 (2013). A client queries the CA's responder for a single certificate's status. OCSP stapling lets the server present a recent signed response itself, avoiding the latency and privacy cost of a client-side lookup.
Official text: RFC 6960
How it fails
OCSP fails open. If the responder is slow or unreachable, browsers proceed rather than block, which makes revocation advisory in practice. That weakness is why the CA/Browser Forum has moved the ecosystem back toward CRLs and made OCSP optional for public CAs — the direction of travel is away from OCSP, so monitoring should not assume a responder will be there.
Related terms
Check this on your own domain
SkyQon reads the same public signals described on this page and scores them for your domain. No account, no agent, nothing to install — a scored report by email in minutes.