IPFYI
RFC 6960 Proposed Standard

X.509 Internet Public Key Infrastructure Online Certificate Status Protocol - OCSP

S. Santesson, M. Myers, R. Ankney, A. Malpani, S. Galperin, C. Adams · 2013-06

Abstract

This document specifies a protocol useful in determining the current status of a digital certificate without requiring CRLs. Additional mechanisms addressing PKIX operational requirements are specified in separate documents. This document obsoletes RFC 2560.

Why This RFC Matters

RFC 6960 defined OCSP as a real-time alternative to Certificate Revocation Lists (CRLs) for checking whether a TLS certificate has been revoked before the end of its validity period. Unlike CRLs that must be downloaded and parsed in their entirety, an OCSP request asks a CA's responder about one specific certificate, returning a signed 'good', 'revoked', or 'unknown' response. OCSP Stapling (RFC 6066) extends this by having the server include a pre-fetched OCSP response in the TLS handshake, improving both performance and privacy, and is now the standard approach for certificate status in modern TLS deployments.

관련 프로토콜

SSL-TLS HTTPS

관련 용어

ssl-tls certificate authentication encryption

Security에서 더 보기

RFC 2404 The Use of HMAC-SHA-1-96 within ESP and AH RFC 3602 The AES-CBC Cipher Algorithm and Its Use with IPsec RFC 4253 The Secure Shell (SSH) Transport Layer Protocol RFC 4254 The Secure Shell (SSH) Connection Protocol RFC 4301 Security Architecture for the Internet Protocol RFC 5246 The Transport Layer Security (TLS) Protocol Version 1.2 RFC 5280 Internet X.509 Public Key Infrastructure Certificate and CRL Profile RFC 6125 Representation and Verification of Domain-Based Application Service Identity within Internet Public Key Infrastructure Using X.509 (PKIX) Certificates in the Context of Transport Layer Security (TLS)