Using the Online Certificate Status Protocol
In this section, we will learn about OCSP. First, we will learn what it is and how it works. Then, we will learn how to use OCSP on the command line and in C programs.
Understanding the Online Certificate Status Protocol
OCSP is a more modern method of certificate revocation checking that uses much less network traffic than CRL. When using OCSP, you don’t need to download large CRL files. Instead, it is possible to query an OCSP server, also known as an OCSP responder, about the status of a particular certificate. Similar to how CRLs are published by the issuer of a particular certificate, OCSP servers are also maintained by the certificate issuer.
When querying an OCSP responder, an OCSP client sends an ASN.1-encoded OCSP request, containing a list of certificates to check for revocation. The OCSP server responds with an ASN.1-encoded OCSP response, which contains the queried certificate statuses, the validity period of...
