I have to test OCSP feature on a SSL server. Since it is a pretty standard feature now, I was looking around for tips on test plans/setting up OCSP responder etc?


An OCSP responder is not part of a SSL server; it is maintained by the Certification Authority which issued the certificate for the SSL server. Indeed, the OCSP responder publishes information on the revocation status for certificates, and it is the CA who chooses which certificate is revoked and which is not.

Thus, OCSP responders usually come with the software for managing the CA. See for instance EJBCA, an Open Source PKI, which comes with its own OCSP responder. There are also stand-alone responders, which feed on CRL produced by the CA; see for instance this one.

Either way, an OCSP responder is only good as far as validators talk to it. Software trying to validate a certificate, in particular a Web browser which acts as client to your server, will use a given OCSP responder only if they know that it exists and where to find it. In practice, this means that the URL to the OCSP responder has to be included in the certificate itself, as part of an Authority Information Access extension. Of course, it is up to the CA to include, or not, such an extension in the certificate, when it issues it.


The clients (eg browsers) while sending the extended clientHello during ssl handshake, are supposed to provide the OCSP responderIDs they trust. If the client doesn't provide the responderID, the responders known to the server will be used. check "certificate status request" in rfc 6066.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.