OCSP Certificate Checker

Real-time Check X.509 RFC 6960
Anish Nath
OCSP Query
Server Certificate
0 chars
Issuer Certificate
0 chars
Let's Encrypt OCSP ended August 2025
OCSP Response

OCSP response will appear here

Paste certificates and click Check OCSP Status
OpenSSL OCSP Commands
Extract OCSP URI from Certificate
# Get OCSP responder URL
$ openssl x509 -in cert.pem -noout -ocsp_uri
Perform OCSP Query
# Check certificate status via OCSP
$ openssl ocsp -issuer issuer.pem -cert cert.pem \
-url http://ocsp.example.com -resp_text
OCSP with CA Bundle
# Verify OCSP response signature
$ openssl ocsp -issuer chain.pem -cert cert.pem \
-CAfile ca-bundle.crt -url http://ocsp.example.com
Related Certificate Tools
PEM Parser

Parse and decode PEM certificates
Certificate Matcher

Verify certificate and key pairs
SSL Checker

Check SSL/TLS configuration
SSL Info

Get SSL certificate details

Support This Free Tool

Every coffee helps keep the servers running. Every book sale funds the next tool I'm dreaming up. You're not just supporting a site — you're helping me build what developers actually need.

500K+ users
200+ tools
100% private
☕ One-time support Buy me a coffee 📚 Learn & support 9-Book Bundle - $9 Stay updated Follow @anish2good
Privacy Guarantee: Private keys you enter or generate are never stored on our servers. All tools are served over HTTPS.
Understanding OCSP
What is OCSP?

OCSP (Online Certificate Status Protocol) defined in RFC 6960 is an Internet protocol used for obtaining the revocation status of X.509 digital certificates. Unlike CRLs (Certificate Revocation Lists), OCSP provides real-time certificate status checking.

OCSP Response Status
Good
Certificate is valid and not revoked
Revoked
Certificate has been revoked by CA
Unknown
OCSP responder doesn't know this certificate
OCSP vs CRL
Feature OCSP CRL
Update Frequency Real-time Periodic
Bandwidth Low (single cert) High (full list)
Privacy CA knows which certs you check Better privacy
Availability Requires online responder Can be cached
Common OCSP Errors
  • Unauthorized: The OCSP responder doesn't recognize the issuer. Make sure you're using the correct intermediate certificate.
  • Try Later: The OCSP responder is temporarily unavailable. Retry after some time.
  • Signature Error: The OCSP response signature verification failed. The response may have been tampered with.
Quick Access