Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have to test OCSP feature on a SSL server. Since it is a pretty standard feature now, I was looking around for tips on test plans/setting up OCSP responder etc?

share|improve this question
up vote 3 down vote accepted

An OCSP responder is not part of a SSL server; it is maintained by the Certification Authority which issued the certificate for the SSL server. Indeed, the OCSP responder publishes information on the revocation status for certificates, and it is the CA who chooses which certificate is revoked and which is not.

Thus, OCSP responders usually come with the software for managing the CA. See for instance EJBCA, an Open Source PKI, which comes with its own OCSP responder. There are also stand-alone responders, which feed on CRL produced by the CA; see for instance this one.

Either way, an OCSP responder is only good as far as validators talk to it. Software trying to validate a certificate, in particular a Web browser which acts as client to your server, will use a given OCSP responder only if they know that it exists and where to find it. In practice, this means that the URL to the OCSP responder has to be included in the certificate itself, as part of an Authority Information Access extension. Of course, it is up to the CA to include, or not, such an extension in the certificate, when it issues it.

share|improve this answer

The clients (eg browsers) while sending the extended clientHello during ssl handshake, are supposed to provide the OCSP responderIDs they trust. If the client doesn't provide the responderID, the responders known to the server will be used. check "certificate status request" in rfc 6066.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.