Bob, concerned that Alice's private key may have been compromised, creates an 'OCSP request' that contains Alice's certificate serial number and sends it to Carol.

Alice wishes to perform a transaction with Bob and sends him her public key certificate.

Alice and Bob have public key certificates issued by Carol, the certificate authority (CA).

OCSP does not mandate encryption, so other parties may intercept this information.

OCSP discloses to the responder that a particular network host used a particular certificate at a particular time.

Since an OCSP response has less data to parse, the client-side libraries that handle it can be less complex than those that handle CRLs.

Since an OCSP response contains less data than a typical certificate revocation list (CRL), it puts less burden on network and client resources.

Most OCSP revocation statuses on the Internet disappear soon after certificate expiration. Some web browsers ( Firefox ) use OCSP to validate HTTPS certificates, while others have disabled it. The 'request/response' nature of these messages leads to OCSP servers being termed OCSP responders. Messages communicated via OCSP are encoded in ASN.1 and are usually communicated over HTTP. It was created as an alternative to certificate revocation lists (CRL), specifically addressing certain problems associated with using CRLs in a public key infrastructure (PKI).

It is described in RFC 6960 and is on the Internet standards track. The Online Certificate Status Protocol ( OCSP) is an Internet protocol used for obtaining the revocation status of an X.509 digital certificate.

Wireshark https requests