OCSP Status Checker

Find the OCSP responder a certificate names, check whether the server staples a response, and see the revocation status when it can be determined.

Passive public check

a2z.tools reads publicly visible information from the address you enter. It is a read-only request - nothing is submitted, changed or probed.

Domain Opens one TLS handshake, reads the certificate, and probes the responders it names.

What this checks, and what it deliberately does not

The Online Certificate Status Protocol lets a client ask a certificate authority whether a specific certificate has been revoked. This tool opens one TLS handshake, reads the certificate, extracts the OCSP responder URLs from its Authority Information Access extension, and checks whether those responders answer.

It does not report a revocation status, and that is a deliberate limit rather than an omission. Getting a definitive answer means constructing a signed OCSP request using the issuing certificate, sending it, and verifying the signature on the response. That is real work, and it is exactly the sort of thing that goes subtly wrong and then reports a perfectly good certificate as revoked. A confident wrong answer about revocation is worse than no answer, so the tool reports what it can actually establish and tells you how to get the rest.

To check status by hand:

openssl s_client -connect example.com:443 -status < /dev/null 2>/dev/null | grep -A 20 "OCSP response"

Stapling, and why it is reported as unknown

OCSP stapling has the server fetch the status itself and attach it to the handshake. It is better for everyone: the visitor gets the answer without a second round trip, and - more importantly - without telling the certificate authority which site they are visiting.

Whether a given server staples cannot be determined by this tool. The stapled response arrives inside the TLS handshake as a certificate status message, and reading it requires a TLS stack that surfaces status_request. The .NET handshake used here does not expose it. Rather than infer stapling from something adjacent and sound confident, the tool reports it as unknown and gives you the one-line command that answers it properly.

OCSP Must-Staple is strong and unforgiving

If the certificate carries the RFC 7633 TLS feature extension, a browser that receives no stapled response is required to refuse the connection. That closes the soft-fail gap properly - but it means any interruption in stapling takes the site offline rather than degrading it. A cache expiry, a responder outage or a configuration change becomes an outage. This tool flags Must-Staple when it is present precisely because the operational consequence is easy to under-estimate.

OCSP is being phased out

This is worth knowing before you treat a missing responder as a fault. OCSP leaks browsing history to the certificate authority - every status check tells them which site a visitor is loading - and the industry has been moving away from it for that reason. Let's Encrypt began removing OCSP URLs from its certificates in 2025. Browsers increasingly rely on aggregated revocation lists they ship themselves, such as Mozilla's CRLite and Chrome's CRLSets, and on short-lived certificates that expire faster than revocation would propagate.

So a certificate with no OCSP responder is increasingly normal. The tool reports it as informational and explains why, rather than as a finding.

A responder that does not answer is a real problem

This is the part a passive check genuinely can establish, and it matters. Most browsers soft-fail: if the responder is unreachable they proceed anyway. Some enterprise and mobile clients hard-fail and will refuse the connection entirely.

That asymmetry produces a very specific support ticket - the site works for everybody except one customer, on one network, intermittently. If this tool reports a responder that is not answering, that is the shape of problem you are looking at. It is the certificate authority's infrastructure rather than yours, but it is your availability.

Frequently asked questions

Why does it not tell me whether the certificate is revoked?

Because doing that correctly requires building a signed OCSP request with the issuer certificate and verifying the response signature. Done imperfectly it reports good certificates as revoked, which is worse than not answering. The page gives you the openssl command that does it properly.

My certificate has no OCSP URL. Is that a problem?

Increasingly not. Let\u0027s Encrypt began removing OCSP URLs in 2025 and the industry is moving to short-lived certificates and browser-shipped revocation lists, because OCSP leaks browsing history to the CA.

How do I check whether my server staples?

openssl s_client -connect yourdomain:443 -status and look for "OCSP Response Status: successful" near the top. This tool cannot read it because the .NET TLS stack does not expose the status_request response.

Should I enable Must-Staple?

Only with monitoring. It closes the soft-fail gap properly, and it means any stapling interruption becomes an outage rather than a degradation. Be certain you would find out quickly if stapling stopped.

References

Related tools

What this tool can and cannot tell you. It reports the configuration a site exposes to an ordinary visitor. It does not log in, submit anything, or test for vulnerabilities, so a passing result means the public configuration looked correct at the moment of the check - not that the site is secure.

Security guidance here follows current published sources - OWASP, MDN, the relevant RFCs, NIST, CISA, FIRST and MITRE - which are linked beside the specific claims they support.