A request names the certificate by issuer name hash, issuer key hash and serial number, usually over HTTP GET or POST to the URL in the certificate's Authority Information Access extension. The response is signed by the CA or a delegated responder certificate with the id-kp-OCSPSigning EKU and carries thisUpdate and nextUpdate; the Baseline Requirements limit the validity of subscriber responses to between 8 hours and 10 days.
Live OCSP lookups leak browsing history to the CA, add latency and fail open in browsers when the responder is unreachable. OCSP stapling moves the fetch to the server, but adoption stayed partial. Ballot SC-063 made OCSP optional for public CAs and CRLs mandatory from 15 March 2024; Let's Encrypt stopped including OCSP URLs in May 2025 and shut down its responders on 6 August 2025, and Firefox 142 stopped querying OCSP for domain-validated certificates in favor of CRLite.
OCSP remains common in private PKIs, smart-card and government systems, and code signing. The OCSP decoder parses requests and responses.