OCSP (Online Certificate Status Protocol)
Definition
A real-time certificate revocation protocol in which the verifier queries the CA's OCSP responder with the certificate's serial number and receives a signed response indicating whether the certificate is currently good, revoked, or unknown.
- Full form
- Online Certificate Status Protocol
- Function
- Real-time certificate revocation check
- Query
- Certificate serial number sent to CA's OCSP responder
- Response states
- Good, revoked, or unknown
Common questions
Why does OCSP matter specifically for validating e-signatures rather than just website certificates?+
An e-signature's legal validity often depends on proving the signing certificate was not revoked at the moment of signing, so a timestamped OCSP response captured at signature time provides evidence the certificate was still trusted then, which matters years later if the certificate has since expired or been revoked.
How does OCSP differ from a Certificate Revocation List (CRL) for forensic verification purposes?+
A CRL is a periodically published list the verifier downloads and checks locally, while OCSP is a live, per-certificate query to the CA at the moment of verification, giving a more current answer but also depending on the CA's responder being reachable and the query itself being logged for later evidence.
What is OCSP stapling and why might it matter to an examiner reviewing a signed document's validation trail?+
OCSP stapling has the certificate holder attach a pre-fetched, signed OCSP response to the certificate itself rather than requiring the verifier to contact the CA directly, which can leave a self-contained, verifiable revocation record embedded with the signed artefact for later review.
Related terms
- Aadhaar E-Sign
- India's authentication-linked electronic signature service in which the user's Aadhaar biometric or OTP authentication triggers the generation of a short-validity signing certificate...
- ESIGN Act (Electronic Signatures in Global and National Commerce Act)
- US federal legislation (2000) providing that no electronic signature may be denied legal effect solely because it is in electronic form. Technology-neutral:...
- EU Trusted List (EUTL)
- The authoritative list maintained by the European Commission listing all Trust Service Providers per EU member state that are supervised to issue...
- Long-Term Validation (LTV)
- A PDF signature profile (PAdES-LTV, ETSI EN 319 102-1) in which the OCSP responses, CRL data, and TSA certificate chain information are...
- Public Key Infrastructure (PKI)
- The system of hardware, software, policies, and standards that manage digital certificates and public-key encryption. Provides the trust architecture underpinning all cryptographic...
- QSCD (Qualified Signature Creation Device)
- A hardware or remote HSM-based device that stores the signer's private key such that it cannot be extracted, ensuring sole control under...
- Qualified Electronic Signature (QES)
- The highest tier of electronic signature under EU eIDAS Regulation 910/2014. Created by a Qualified Signature Creation Device (QSCD), backed by a...
- TSA Timestamp (Timestamp Authority)
- A cryptographically protected record of the time at which a signature was created, issued by a Timestamp Authority (TSA) whose own certificate...
- X.509 Certificate
- A digitally signed data structure that binds a public key to a named identity (subject) and is issued by a Certificate Authority....