enter image description here

In the case of OCSP stapling in the browsers, it works this way. But my question is, in a case where I have a communication between Alice and Bob how this works? I know that if I use OCSP normal, both parties goes to the CA, but in the case of OCSP Stapling, how it works? Any example?


1 Answer 1


OCSP stapling is an extension to the TLS protocol which is defined in RFC 6066 and extended in RFC 6961. The client announces support OCSP stapling to the server during the TLS handshake and if the server has a OCSP response for stapling it will be send as CertificateStatus with the TLS handshake.

It does not matter who fills the role of client and server: The server might be a web server supporting TLS and the client might be a web browser as in your question. Or the server might be a mail server supporting TLS and the client a mail client. Or the server might be Bob and the client Alice, speaking their own protocol protected by TLS. All it matters is that both sides use TLS for communication and that the client requests OCSP stapling and the server provides the OCSP response within CertificateStatus.

  • Thanks for the quickly answer! One question: In the case of Alice and Bob, are you saying that one of them has to have the server behavior, and so, is it that makes the request to the CA periodically of the state of the certificate right? But only one of them, Alice or Bob, right?
    – PRVS
    May 11, 2017 at 19:13
  • @PRVS: OCSP stapling is defined for TLS. With TLS you always have a client side which initiates the TLS handshake and a server side. May 11, 2017 at 19:13
  • But the server acts as OCSP responder? And this OCSP responder (the server - Bob for example) requests periodically the CA?
    – PRVS
    May 11, 2017 at 20:17
  • @PRVS: With OCSP stapling the server is not an OCSP responder but just gets the OCSP response like the browser would do and includes it in the TLS handshake. But, this is actually a different question than your original one because now you are asking how OCSP stapling works in general instead of asking how OCSP stapling works between Alice and Bob compared to between a web browser and a server. New questions should not be asked in a comment. So if you need to ask anything outside your original question please create a new real question. May 11, 2017 at 20:22
  • I think that this is not a new question. I only don't know who is the OCSP responder, and the CA what makes
    – PRVS
    May 11, 2017 at 20:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .