OCSP (Online Certificate Status Protocol)
An IETF standard for checking the validity of digital certificates in an X.509 PKI authentication system.
Under OSCP, issued certificates carry an OCSP "authority identifier" field. Certificate applications use OCSP "requestor" software to request status from an OCSP "responder."
The goal is to provide a more efficient way of distributing certificate authentication information than an earlier method in which a potentially large "certificate revocation list" was periodically posted to the network - and downloaded by clients on the network.
When an OSCP-enabled certificate is presented to a security application, such as a Web browser during initiation of an SSL session, the software checks the certificate to make sure it is valid before the associated operation can proceed. The certificate contains control information to show when it is valid (start and end time) and, optionally, address information to access a CRL or an OCSP responder. The certificate-processing software - the browser or other application - can use an OCSP responder it has been configured for, or the one listed in the certificate, to check the status.
The process of checking a certificate's status has always been part of the design of certificate infrastructures. It was there to allow for revocation, to ensure that the identity information represented by a certificate is valid at the time the certificate is used. Historically, because CRLs were hard to use, this part of the design was omitted from early deployments. Now that OCSP is a standard, and now that vendors such as CoreStreet, RSA, VeriSign and others support OCSP, it makes sense to start upgrading your certificate infrastructure to add certificate-status-checking capability. This does require OCSP support in the security systems that use it, including browsers and other software, but most modern Certificate Authority products support OCSP, and there are OCSP add-on tools to provide requestors.
From http://www.nwfusion.com/reviews/2004/0809revside.html">Fitting OCSP into your Certificate Infrastructure, Network World, 08/09/04.
Additional resources
RFC 2560
Defines OCSP.
CoreStreet scales digital certificates
We test an OCSP certificate system. Network World, 08/09/04.
Security research center
Latest security news, analysis and resource links.
Add a comment
