What does OCSP stand for?
OCSP stands for Online Certificate Status Protocol. A protocol for checking one certificate's revocation status in real time, instead of downloading a whole CRL. OCSP stapling lets the server provide the answer.
OCSP is a way to ask a certificate authority whether one certificate is still valid. The client sends the certificate's serial number to the authority's responder and receives a signed answer: good, revoked or unknown. It is quicker than downloading a whole revocation list. With OCSP stapling, the web server fetches the signed answer itself and sends it along during the TLS handshake, so the browser does not have to contact the authority.
OCSP in practice: an example
A company discovers that the private key of its web certificate was copied and asks the certificate authority to revoke the certificate. From that moment the responder answers revoked for that serial number, and browsers that check it warn users instead of connecting, although the certificate's expiry date is still months away.
What OCSP is confused with
OCSP vs CRL: what is the difference?
A CRL is a complete list of revoked certificates that the client downloads and searches. OCSP answers a question about one certificate at the moment it is asked. What CRL stands for
OCSP vs OCSP stapling: what is the difference?
In plain OCSP the client asks the authority. In stapling the server delivers a recent signed response with its certificate, which is faster and does not tell the authority which sites the user visits.
Which exams cover OCSP?
OCSP is on the official CompTIA acronym list for one of the four exams covered here.
- Security+ SY0-801: 1.3 (General Security Concepts).
Each number is a CompTIA exam objective and the name in brackets is its domain. The exam puts the term in a scenario; it does not ask you to recite the expansion.
Check yourself: two practice questions
Written by CertSprint for this page. They are not taken from any exam.
1. A browser needs the current status of one certificate without downloading a large list. Which mechanism does it use?
- OCSP
- DHCP
- A certificate signing request
- Key escrow
Show the answer
A. OCSP. OCSP returns the status of a single certificate on request. A signing request is used to obtain a certificate, not to check one.
2. What does OCSP stapling change?
- The certificate no longer expires
- The web server sends the signed status response during the TLS handshake
- The private key is sent to the browser
- Revocation is disabled
Show the answer
B. The web server sends the signed status response during the TLS handshake. The server attaches a fresh response from the authority, so the client gets the status without a separate lookup.
Sources: RFC 6960: X.509 Internet Public Key Infrastructure Online Certificate Status Protocol; RFC 6066: Transport Layer Security (TLS) Extensions: Extension Definitions (certificate status request); NIST glossary: Online Certificate Status Protocol. The acronym and its expansion come from CompTIA's official acronym lists, linked from each exam glossary above. The explanation, example and questions are CertSprint's own, checked against these sources on 11 November 2026.