How to Check the OCSP Address of an SSL Certificate?
We have provided a detailed explanation of what OCSP for SSL certificates is and what functions OCSP serves in What is OCSP? What is the Role of OCSP?.
Here, we will again provide a comprehensive introduction to this concept and how to distinguish different OCSP setups, and this article will show you how to check the OCSP address of a certificate.
Recommended SSL Certificates with OCSP Localization
Put simply, when end users visit a website protected by an SSL certificate, a real-time query of the certificate status is performed. If the certificate's signature verification server is located in mainland China, domestic users will be able to query the real-time certificate status faster and more stably.
Therefore, when purchasing an SSL certificate, you can consider the region where your end users are located, and choose a brand whose OCSP signature verification server is physically closer, or a brand with global OCSP (not restricted by the access location).
For users in mainland China, we recommend SSL certificates with OCSP localization. These certificates use domestic servers to verify the issuance status of SSL certificates, which can greatly improve HTTPS access speed. At the same time, SSL certificate status queries are more stable, which can well meet the security and performance requirements of various enterprises for SSL certificates. Currently, brands such as sslTrus, CFCA, DigiCert, and GlobalSign support domestic OCSP query and signature verification.
For detailed information: Which SSL Certificate Brands Support Domestic OCSP?
How to Check the OCSP Address of a Certificate?
How can you check whether the OCSP signature verification server address on the actual SSL certificate page is global or domestic?
Please open the detailed introduction page of the SSL certificate, or open the certificate details page on a site where the SSL certificate is already installed. Major browsers display this differently, usually in the form of a small padlock icon. Here we take the official Racent website as an example: Racent Official Website, and the browser used by the author is 360 Browser.
As shown in the figure, you can view the OCSP Responder URL in the 【Authority Information Access】 field: http://ocsp.sectigochina.com
You can then judge the OCSP address by observing the suffix of the domain name: for example, .cn indicates a domestic address, while .com is an international address. Alternatively, you can query the IP location corresponding to the domain name to find out where the signature verification server is located.