I was wondering if the connection towards the ocsp responder/server is TLS encrytped itself. Meaning that the client requesting a validity check for a certificate verifies the OCSPs server certificate? If so that OCSP server should be signed by the a root ca (which the client can verify via its truststore) in order to not end up in an infinite loop, right?

I think that OCSP validation comes before certificate chain validation.

Any clarification would be great.

1 Answer 1


I think that OCSP validation comes before certificate chain validation.

it is not very correct. At first, certificate chain is built and validated. Once successfully validated, a revocation checking is performed. OCSP is checked during revocation checking process. Depending on TLS implementation, an OCSP response can be stapled in TLS handshake messages, so client isn't required to query external OCSP, the signed response is already there.

OCSP certificate itself is checked for chain validity only. Normally, OCSP signing certificates do not include any revocation information and include a id-pkix-ocsp-nocheck certificate extension which instructs client to not perform revocation checking of OCSP signing certificate even if revocation information is included in CDP/AIA extensions.

  • Thank you for the fast response and explanation. Both of my questions are answered. I thought you could save time by first checking if a certificate is valid or not, but interesting to know, that it first checks for the chain. Regarding OCSP stapling: The client will still verify the signed response that the e.g. webserver got from the OCSP server, correct? If not, this message could be faked.
    – metriXc
    Sep 24, 2021 at 12:49
  • @metriXc: Checking the chain is an offline operation, checking OCSP instead is an online operation unless OCSP stapling was used - so doing chain validation first is usually faster. OCSP responses are signed and the signature will be checked by the (properly implemented) endpoint checking the certificate, since trusting the server in OCSP stapling is not enough. Sep 24, 2021 at 13:18
  • @SteffenUllrich okay that makes sense. So the (properly implemented) client will verify the signature from the OCSP response. It does this with the public key of the signer I guess. (regular digital signature validation) Thank you.
    – metriXc
    Sep 24, 2021 at 13:41
  • 1
    OCSP response may contain its chain to validate the OCSP signing chain. And it can be different than the chain of TLS certificate.
    – Crypt32
    Sep 24, 2021 at 14:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .