OCSP Status Checker Guide: Verify Certificate Revocation

A website's certificate proves its identity, but certificates can be compromised, misissued, or retired before they expire, and expiry alone does not tell a visitor whether a certificate is still trustworthy. That is the job of revocation checking, and OCSP, the Online Certificate Status Protocol, is one of its main mechanisms: a browser or a checker asks the certificate authority's OCSP responder whether a given certificate is still good, and the responder answers good, revoked, or unknown. The OCSP Status Checker helps you interpret such a status for a certificate you supply, based on the certificate and response details you paste in. It is a format and consistency check on pasted input, not a live query to a certificate authority, and its report describes the input you gave it rather than the certificate's live status at this moment.

To understand OCSP, it helps to see where it sits among revocation methods. The oldest method is the certificate revocation list, a periodically published list of revoked certificates that a browser downloads in full, which works but grows large and goes stale between updates. OCSP improves on that by answering a question about one certificate at a time, so the response is small and current, but it introduces its own costs: the browser must contact the responder for each certificate, which adds latency and a privacy concern, since the responder learns which sites are being visited. A later optimization, OCSP stapling, has the web server itself fetch a signed, time-limited OCSP response from the responder and attach it to the handshake, so the browser gets a fresh status without contacting the responder directly. Stapling is the arrangement most site owners should aim for, because it gives visitors current status without the latency and privacy costs of direct queries.

Reading an OCSP response means understanding its three possible answers and their limits. "Good" means the responder has no record of revocation for the certificate, which is reassuring but not absolute: it means not revoked as far as this responder knows, at the time the response was signed. "Revoked" means the certificate authority has revoked the certificate, and the certificate should not be trusted, full stop. "Unknown" means the responder does not recognize the certificate, which can happen when the responder serves a different authority, when the certificate is very new, or when the query itself was malformed, and it should be investigated rather than treated as either good or revoked. Responses also carry timing: they are signed at a moment and valid until a moment, and a response past its validity window should not be trusted, just as an expired certificate should not. A checker that reports the status without the validity window is giving you half the answer.

Worked example

Take a sample certificate, with values clearly labelled as an illustration. A site's certificate is issued on 1 June 2027 and expires on 30 August 2027, a lifetime of 90 days. On 20 June, the site's administrator checks the OCSP status by supplying the certificate details and a responder reply, and the checker reports "good", signed on 20 June and valid until 27 June, a window of 7 days. The certificate is therefore trusted, with a fresh status. On 5 July, after a suspected key compromise, the authority revokes the certificate, and a new check reports "revoked", with the revocation time recorded as 5 July. Any visitor whose browser honours the revocation will now refuse the certificate, even though its expiry date of 30 August has not passed, which is exactly why revocation exists: expiry alone would have left the compromised certificate trusted for 56 more days, from 5 July to 30 August. In a third variation, the checker reports "unknown" for a certificate that the site believes is valid; investigation shows the responder address pasted into the check belongs to a different authority, and correcting the address produces a "good" response. The lesson is to check the responder as well as the status, because an answer from the wrong authority is not an answer at all.

Mistakes to avoid

The first mistake is treating "good" as permanent: OCSP status is a snapshot with a validity window, and a certificate good today can be revoked tomorrow. The second is treating "unknown" as "good", when it means the responder could not answer and the situation needs investigation. The third is ignoring stapling: a site without stapling forces every visitor's browser to query the responder, adding latency and leaking browsing patterns. The fourth is forgetting that revocation only helps if clients check it: some clients soft-fail, treating an unreachable responder as permission to proceed, which means a revoked certificate may still be accepted when the responder cannot be reached. The fifth is pasting private key material into any checker alongside a certificate: a certificate itself is public by design, but its private key must never accompany it anywhere, and any key that has been pasted into a tool should be considered exposed and replaced.

Putting it into practice

Check a certificate's status after issuance, after any suspected compromise, and when visitors report trust errors, and confirm that your server staples a fresh OCSP response so visitors get status without extra queries. Treat a revoked result as an immediate instruction to replace the certificate, not as a warning to monitor. For related tools, the SSL Certificate Checker verifies the certificate chain itself, the SSL Certificate Expiry Checker tracks expiry dates, and the companion guide on the Certificate Authority Checker explains how issuers are validated. Expiry tells you when a certificate ends; OCSP tells you whether it ended early, and that difference is what revocation checking exists to catch.

Key points

  • OCSP answers whether a specific certificate is good, revoked, or unknown, based on the certificate authority's current records
  • A good response is a time-limited snapshot, not a permanent verdict, and a revoked certificate must not be trusted even before expiry
  • An unknown response means the responder could not answer and needs investigation, not a pass
  • OCSP stapling lets the server attach a fresh signed response, avoiding per-visitor responder queries

In short: check status with its validity window, treat revoked as an order to replace the certificate, staple fresh responses on your server, and never paste a private key into any checker.