SSL & Security

OCSP Checker

Revocation Status

OCSP status check

Enter a domain name to check its SSL certificate revocation status using OCSP (Online Certificate Status Protocol).

Tool features

Comprehensive OCSP status checking and certificate security analysis
4 checks

OCSP Status Check

Check certificate revocation status using Online Certificate Status Protocol

Certificate Validation

Verify certificate validity and check for revocation

OCSP Stapling Detection

Detect if OCSP stapling is enabled for improved performance

Security Score

Get an overall security score with improvement recommendations

What is OCSP & how it works

Real-time certificate revocation checking

OCSP (Online Certificate Status Protocol) is how a client asks a certificate authority, in real time, whether a certificate is still valid or has been revoked. Even a certificate that hasn't expired can be revoked — for example if its private key was compromised — and OCSP is the mechanism that lets browsers find out before trusting it.

This checker locates the OCSP responder listed in the certificate, sends a status request, and reports whether the certificate is good, revoked, or unknown. It also shows whether the site supports OCSP stapling, where the server attaches a fresh, signed status response to the TLS handshake — improving both privacy and page-load speed.

Revocation
Invalidating a certificate before its expiry date, usually due to key compromise or mis-issuance.
OCSP stapling
The server fetches and attaches the OCSP response itself, so clients don't have to contact the CA — faster and more private.
Responder
The CA endpoint (a URL in the certificate) that answers OCSP status queries for that certificate.

How to use this tool

Check a certificate's revocation status in four steps
1
Enter a domain name
Type the hostname whose certificate you want to check, such as example.com.
2
Run the OCSP check
We read the certificate, find its OCSP responder, and query the current revocation status.
3
Review the status
See whether the certificate is good, revoked, or unknown, and whether stapling is enabled.
4
Act on a bad status
If revoked, replace the certificate immediately; if stapling is missing, enable it on the server.

Related tools

Keep debugging with tools from the same suite
4 tools
SSL Checker
Comprehensive SSL certificate analysis including validity, expiration, chain verification, TLS versions, and security assessment
Certificate Chain Checker
Verify your SSL certificate chain order, detect missing intermediate certificates and expired certs, and download a correctly-ordered bundle. Paste a PEM bundle or check a live host
Certificate Decoder
Decode and analyze SSL certificate contents, properties, and metadata in detail
SSL Expiration Checker
Check SSL certificate expiration dates and get alerts before certificates expire

Frequently asked questions

Common questions about OCSP and certificate revocation
5 Q&A

An expired certificate has simply passed its validity date. A revoked certificate was invalidated early by the CA — often because its private key was compromised — even though it hasn't expired yet.

With stapling, the web server fetches a signed OCSP response from the CA and attaches it to the TLS handshake. Clients get the revocation status without contacting the CA, which is faster and protects user privacy.

It means the CA confirms the certificate is valid and has not been revoked as of the response's timestamp. This is the status you want to see.

The responder may not have information for that certificate — for instance if it was issued by a different CA than expected, or the OCSP URL is misconfigured.

Some CAs are moving toward CRLs and short-lived certificates as OCSP is phased down, but OCSP and especially OCSP stapling remain widely used for real-time revocation checking today.