The discussion at Why isn't OCSP required by default in browsers? notes that many browsers by default simply ignore failure to check web site TLS certificate revocation status via the Online Certificate Status Protocol (OCSP).

Is there a simple way (e.g. a tool) for users who care about it, or are just curious, to monitor OCSP requests and detect or log when connections fail? E.g. a browser extension would be handy.

I'm curious about all the popular platforms and browsers.

Update: Poking around a bit more found this explanation of the basic OCSP flow and how to do it step-by-step with openssl: OCSP verification with OpenSSL.

-----BEGIN WHINE-----
back in the good old days before HTTP became a crufty swiss army knife, I'd just have to capture all packets for the "OCSP port". But no - OCSP is layered on top of HTTP, so I need more than a simple pcap-based tool: I need to figure out which HTTP URLs out there are OCSP-related, and parse the more wordy conversations....
-----END WHINE-----

The discussion at Why isn't OCSP required by default in browsers? notes that many browsers by default simply ignore failure to check web site TLS certificate revocation status via the Online Certificate Status Protocol (OCSP).

Is there a simple way (e.g. a tool) for users who care about it, or are just curious, to monitor OCSP requests and detect or log when connections fail? E.g. a browser extension would be handy.

I'm curious about all the popular platforms and browsers.

Update: Poking around a bit more found this explanation of the basic OCSP flow and how to do it step-by-step with openssl: OCSP verification with OpenSSL.

-----BEGIN WHINE-----
back in the good old days before HTTP became a crufty swiss army knife, I'd just have to capture all packets for the "OCSP port". But no - OCSP is layered on top of HTTP, so I need more than a simple pcap-based tool: I need to figure out which HTTP URLs out there are OCSP-related, and parse the more wordy conversations....
-----END WHINE-----

The discussion at Why isn't OCSP required by default in browsers? notes that many browsers by default simply ignore failure to check web site TLS certificate revocation status via the Online Certificate Status Protocol (OSCP).

Is there a simple way (e.g. a tool) for users who care about it, or are just curious, to monitor OSCP requests and detect or log when connections fail? E.g. a browser extension would be handy.

I'm curious about all the popular platforms and browsers.

Update: Poking around a bit more found this explanation of the basic OCSP flow and how to do it step-by-step with openssl: OCSP verification with OpenSSL.

-----BEGIN WHINE-----
back in the good old days before HTTP became a crufty swiss army knife, I'd just have to capture all packets for the "OCSP port". But no - OCSP is layered on top of HTTP, so I need more than a simple pcap-based tool: I need to figure out which HTTP URLs out there are OCSP-related, and parse the more wordy conversations....
-----END WHINE-----

The discussion at Why isn't OCSP required by default in browsers? notes that many browsers by default simply ignore failure to check web site TLS certificate revocation status via the Online Certificate Status Protocol (OCSP).

Is there a simple way (e.g. a tool) for users who care about it, or are just curious, to monitor OCSP requests and detect or log when connections fail? E.g. a browser extension would be handy.

I'm curious about all the popular platforms and browsers.

Update: Poking around a bit more found this explanation of the basic OCSP flow and how to do it step-by-step with openssl: OCSP verification with OpenSSL.

-----BEGIN WHINE-----
back in the good old days before HTTP became a crufty swiss army knife, I'd just have to capture all packets for the "OCSP port". But no - OCSP is layered on top of HTTP, so I need more than a simple pcap-based tool: I need to figure out which HTTP URLs out there are OCSP-related, and parse the more wordy conversations....
-----END WHINE-----

The discussion at Why isn't OCSP required by default in browsers? notes that many browsers by default simply ignore failure to check web site TLS certificate revocation status via the Online Certificate Status Protocol (OSCP).

Is there a simple way (e.g. a tool) for users who care about it, or are just curious, to monitor OSCP requests and detect or log when connections fail? E.g. a browser extension would be handy.

I'm curious about all the popular platforms and browsers.

The discussion at Why isn't OCSP required by default in browsers? notes that many browsers by default simply ignore failure to check web site TLS certificate revocation status via the Online Certificate Status Protocol (OSCP).

Is there a simple way (e.g. a tool) for users who care about it, or are just curious, to monitor OSCP requests and detect or log when connections fail? E.g. a browser extension would be handy.

I'm curious about all the popular platforms and browsers.

Update: Poking around a bit more found this explanation of the basic OCSP flow and how to do it step-by-step with openssl: OCSP verification with OpenSSL.

-----BEGIN WHINE-----
back in the good old days before HTTP became a crufty swiss army knife, I'd just have to capture all packets for the "OCSP port". But no - OCSP is layered on top of HTTP, so I need more than a simple pcap-based tool: I need to figure out which HTTP URLs out there are OCSP-related, and parse the more wordy conversations....
-----END WHINE-----