What is a benefit of Online Certificate Status Protocol (OCSP)?

The Online Certificate Status Protocol (OCSP) is an Internet protocol used for obtaining the revocation status of a specific X.509 digital certificate. Unlike Certificate Revocation Lists (CRLs), which require a client to download a potentially large list of all revoked certificates, OCSP allows a client to send a real-time query about a single certificate's status to a trusted OCSP responder. The responder provides a digitally signed response indicating if the certificate is 'good', 'revoked', or 'unknown'. This method is more efficient and provides more timely revocation information than CRLs.

B. Certificate renewal is a management function handled by protocols like SCEP (Simple Certificate Enrollment Protocol) or ACME, not a status-checking protocol like OCSP.
C. This describes the function of a Certificate Revocation List (CRL), not OCSP. OCSP was developed as a more efficient alternative to downloading entire CRLs.
D. Trust is established by validating a certificate's chain up to a pre-installed, trusted root CA certificate. OCSP checks revocation but does not replace this fundamental trust anchor requirement.

1. Internet Engineering Task Force (IETF) RFC 6960: X.509 Internet Public Key Infrastructure Online Certificate Status Protocol - OCSP.

Section 1

Introduction: "The Online Certificate Status Protocol (OCSP) enables applications to determine the (revocation) state of an identified certificate. OCSP may be used to satisfy some of the operational requirements of providing more timely revocation information than is possible with CRLs and for providing status information about certificates issued by other CAs." This directly supports that OCSP is for querying the status of a single

identified certificate.

2. Aruba ClearPass 6.11 User Guide:

Page 1001

"Configuring EAP-TLS Authentication Method": In the description for the "Enable OCSP" setting

the guide states

"When enabled

ClearPass uses the Online Certificate Status Protocol (OCSP) to check the client certificate's revocation status." This confirms OCSP's role in checking a certificate's status within the Aruba ecosystem.

3. MIT OpenCourseWare

6.857 Computer and Network Security

Fall 2017:

Lecture 13 Notes

"Public Key Infrastructure (PKI)": The notes describe OCSP as follows: "Client sends certificate serial number to OCSP responder. Responder returns signed message: good

revoked

or unknown." This academic source confirms the single-certificate query mechanism.