What Is Online Certificate Status Protocol (OCSP)?

How an OCSP check works

The client sends the certificate’s serial and issuer hash to the responder; the response is signed by the CA (or a delegated responder certificate) with its own validity window, typically hours to days. Responses are cacheable, and the signature means even a compromised transport cannot forge a "good".

Stapling: fixing privacy and latency

Plain OCSP has two structural problems: the CA learns which sites each client visits, and an unreachable responder forces clients to choose between failing open (soft-fail — the browser default, which an attacker can trigger by blocking OCSP) and failing closed (outage risk). OCSP stapling solves both: the server fetches its own OCSP response periodically and staples it into the TLS handshake, so clients get fresh, signed status with no extra connection.

The must-staple certificate extension was meant to make stapling mandatory per-certificate, but deployment never reached critical mass — Let’s Encrypt dropped support for it in 2025, and browser revocation checking has largely moved to aggregated feeds (CRLite, CRLSets) built from CA CRLs.

Operating an OCSP responder

For internal CAs (ADCS includes a responder role), the operational duties mirror CRLs: keep the responder reachable from everywhere certificates are used, renew its delegated signing certificate before expiry, and monitor that answers are timely and correct — a responder that says "unknown" is a slow-motion outage.

How MI Support IT can help

PKI Tools is built by MI Support IT, a Danish IT company with deep specialization in enterprise PKI: ADCS design and health checks, Venafi certificate automation, key ceremonies and CP/CPS documentation. Read about our PKI services or get in touch.