OCSP (Online Certificate Status Protocol)

OCSP (Online Certificate Status Protocol, RFC 6960) is a protocol for real-time verification of the revocation status of an electronic certificate, by querying an OCSP responder operated by the certification authority. Why revocation matters: a certificate can be valid by date but revoked in advance (key compromise, employee departure); a signature or TLS connection must therefore check the status, not just the expiration. OCSP vs CRL: OCSP is a lighter and more reactive alternative to a CRL — instead of downloading the entire revocation list, the client queries a single certificate and receives a concise signed response (valid / revoked / unknown). OCSP Stapling: to avoid a privacy leak and an extra round trip, the server retrieves its own OCSP response and "staples" it in the TLS handshake, so the browser never directly contacts the CA. In signed documents: OCSP responses are embedded in the PDF at the time of signature for long-term validation (LTV), so the signature remains verifiable years later even if the responder is offline.