Basics: Online Responder (Online Certificate Status Protocol, OCSP)
Certificates usually have a "CRL Distribution Points" extension that tells an application where the certificate's associated certificate revocation list (CRL) can be found.
This is like a telephone directory: It contains all the serial numbers of certificates that have been revoked by the certification authority (and are still within their validity period). Every application that checks the revocation status must download and evaluate the entire certificate revocation list.
As the size increases, this procedure becomes increasingly inefficient. As a rule of thumb, 100,000 revoked certificates already correspond to approx. 5 MB file size for the certificate revocation list.
The Online Certificate Status Protocol (OCSP) was developed for this purpose (under the leadership of ValiCert): It is similar to a directory assistance service where applications can request the revocation status for individual certificates, thus eliminating the need to download the entire CRL. OCSP is specified in RFC 6960 .
Continue reading "Basics: Online Responder (Online Certificate Status Protocol, OCSP)"