4

I have a PEM file that encodes a site's leaf certificate. I'd like to check it hasn't been revoked by querying the relevant OCSP server but I don't know which URL to use.

How can I extract the OCSP URL from the certificate?

7

This information is exposed when you use openssl x509 with the -text option:

$ openssl x509 -in cert.pem -noout -text

It's visible in the x509v3 extensions block:

Authority Information Access: 
  OCSP - URI:http://ocsp.int-x3.letsencrypt.org
  CA Issuers - URI:http://cert.int-x3.letsencrypt.org/

If you are only interested in this information, you can directly use -ocsp_uri instead of -text:

$ openssl x509 -in cert.pem -noout -ocsp_uri 
http://ocsp.int-x3.letsencrypt.org
1
  • @Mathieu Rey - Your edit was rejected for no good reason, I've approved it myself. – Adam Williams Aug 7 '19 at 20:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.