I have a PEM file that encodes a site's leaf certificate. I'd like to check it hasn't been revoked by querying the relevant OCSP server but I don't know which URL to use.
How can I extract the OCSP URL from the certificate?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
This information is exposed when you use
openssl x509 with the
$ openssl x509 -in cert.pem -noout -text
It's visible in the x509v3 extensions block:
Authority Information Access: OCSP - URI:http://ocsp.int-x3.letsencrypt.org CA Issuers - URI:http://cert.int-x3.letsencrypt.org/
If you are only interested in this information, you can directly use
-ocsp_uri instead of
$ openssl x509 -in cert.pem -noout -ocsp_uri http://ocsp.int-x3.letsencrypt.org