I have a PEM file that encodes a site's leaf certificate. I'd like to check it hasn't been revoked by querying the relevant OCSP server but I don't know which URL to use.

How can I extract the OCSP URL from the certificate?

1 Answer 1


This information is exposed when you use openssl x509 with the -text option:

$ openssl x509 -in cert.pem -noout -text

It's visible in the x509v3 extensions block:

Authority Information Access: 
  OCSP - URI:http://ocsp.int-x3.letsencrypt.org
  CA Issuers - URI:http://cert.int-x3.letsencrypt.org/

If you are only interested in this information, you can directly use -ocsp_uri instead of -text:

$ openssl x509 -in cert.pem -noout -ocsp_uri 
  • @Mathieu Rey - Your edit was rejected for no good reason, I've approved it myself. Aug 7, 2019 at 20:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.