OCSP / revocation check

What it checks

• The stapled OCSP response the server sends in the TLS handshake: whether there is one, whether it is for this certificate, and whether it is still fresh.
• The CA's OCSP responder, from the certificate's Authority Information Access extension: the status (good, revoked or unknown), thisUpdate, nextUpdate, producedAt, who signed it and how long it took to answer.
• The CRL from the certificate's CRL Distribution Points: whether the serial is listed, with the revocation date and reason, how many entries it holds, and whether it is out of date.
• Signatures on OCSP responses and CRLs, checked against the issuing CA or a delegated OCSP responder the CA authorised. A response that can't be checked is shown as not checked, never as verified.
• OCSP Must-Staple (the TLS feature extension): a certificate that demands a stapled response from a server that doesn't send one fails in Firefox.

Only ordinary requests are made: one TLS handshake, one OCSP query and one CRL download of up to 10 MB.

OCSP, CRLs and what browsers do

A CA publishes revocations in two ways. A CRL is a signed list of every revoked serial number. OCSP answers about one certificate at a time. Chrome and Firefox no longer ask OCSP responders during browsing: they ship their own compressed revocation lists (CRLSets and CRLite) built from CA CRLs.

Because of that, Let's Encrypt shut down its OCSP service in 2025 and other CAs are following. A certificate without an OCSP URL is normal now; the CRL is the source of truth.

Questions

Why does my certificate have no OCSP URL?

Your CA publishes revocations only in CRLs. Let's Encrypt dropped OCSP in 2025 and several other CAs have done the same. Browsers check revocation through lists built from CRLs, so nothing is broken.

Do I need OCSP stapling?

Only if the certificate has the Must-Staple extension, in which case Firefox refuses to connect without a valid stapled response. Otherwise stapling is optional and does no harm if the CA still runs OCSP.

What should I do if my certificate shows as revoked?

Get a new certificate with a new private key and install it straight away. Browsers refuse revoked certificates, and a revocation for key compromise means someone else may hold the key.

Why does an expired certificate show good or unknown?

CAs may remove expired certificates from their CRLs and stop answering OCSP for them, so their status is no longer reliable. An expired certificate fails anyway.