OCSP vs CRL — what is the difference?

CRL (Certificate Revocation List) is a list of all revoked serial numbers — it can be large and slow to download. OCSP is a real-time query for a single certificate's status. OCSP stapling combines the best of both: real-time status without the client round-trip.

What if the OCSP responder is down?

The server cannot staple a response and falls back to a normal handshake. The client may then check OCSP itself (with a timeout) or accept the certificate (soft-fail). This is a weakness of OCSP — consider OCSP Must-Staple for critical certificates.

Activer OCSP stapling pour faster TLS handshakes

OCSP stapling lets le serveur provide un fresh revocation vérifier en le client pendant le TLS handshake, avoiding un separate round-trip en le CA.

1

Without OCSP stapling, the client must contact the CA's OCSP responder to check if the certificate is revoked — an extra round-trip that adds latency and leaks browsing history to the CA. With stapling, the server fetches the OCSP response and "staples" it to the TLS handshake.
2

Outil RSA →
Verify the certificate supports OCSP by checking the Authority Information Access (AIA) extension, which contains the OCSP responder URL. Without this, stapling cannot work.
3

Calculatrice de hash →
Hash the OCSP response to verify it has been updated recently. OCSP responses have a validity period (typically a few hours); the server must refresh them before expiry.
4

Configure your web server (nginx: ssl_stapling on; Apache: SSLUseStapling on) to fetch and cache OCSP responses. If the OCSP responder is unreachable, the server falls back to a handshake without stapling. Monitor the OCSP fetch success rate.

Questions fréquentes

OCSP vs CRL — what is the difference?: CRL (Certificate Revocation List) is a list of all revoked serial numbers — it can be large and slow to download. OCSP is a real-time query for a single certificate's status. OCSP stapling combines the best of both: real-time status without the client round-trip.
What if the OCSP responder is down?: The server cannot staple a response and falls back to a normal handshake. The client may then check OCSP itself (with a timeout) or accept the certificate (soft-fail). This is a weakness of OCSP — consider OCSP Must-Staple for critical certificates.