SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/secplus-ocsp-status

Which protocol lets software check the revocation status of a certificate online, more timely than CRLs?

OCSP, the online certificate status check.

Start playing free

  1. Online Certificate Status Protocol (OCSP) ✔
  2. Simple Network Management Protocol (SNMP)
  3. Lightweight Directory Access Protocol (LDAP)

Why: Instead of downloading a whole CRL, a client asks an OCSP responder about one certificate. The answer is usually fresher than a periodically published list.

Huh, didn't know that: RFC 6960 says OCSP can be used when more timely revocation information than CRLs provide is needed.

The dad joke
OCSP is the only protocol that answers a question about someone's status without any drama.
Like this card?
Play the game

References

Answer: Online Certificate Status Protocol (OCSP). Instead of downloading a whole CRL, a client asks an OCSP responder about one certificate. The answer is usually fresher than a periodically published list.

  1. RFC 6960, Online Certificate Status Protocol (OCSP) www.rfc-editor.org/rfc/rfc6960
    The Online Certificate Status Protocol (OCSP) enables applications to determine the (revocation) state of identified certificates.
    Checked 2026-10-10.
  2. RFC 6960, Online Certificate Status Protocol (OCSP) www.rfc-editor.org/rfc/rfc6960
    more timely revocation information than is possible with CRLs
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Security & PrivacyWhat is a certificate revocation list (CRL)?Security & PrivacyWhich key does a recipient use to verify a digital signature?Security & PrivacyWhat do you send to a certificate authority to request a certificate?

That's stuff everyone should know.