How to Check the OCSP of an SSL Certificate?
What is OCSP for SSL certificates? What does OCSP do? We have provided a detailed explanation in What is OCSP? What Does OCSP Do?.
Here we will once again introduce this concept and how to distinguish OCSP, and this article will teach you how to check the OCSP address of a certificate.
Recommended SSL Certificates Supporting Localized OCSP
Simply put, when end users visit a website protected by an SSL certificate, the certificate status is queried in real time. If the certificate's validation server is located in China, domestic users will be able to query the certificate's real-time status more quickly and stably.
Therefore, when purchasing an SSL certificate, users can consider the location of their end users and choose a brand whose OCSP validation server is physically closer, or a brand with global OCSP (not restricted by access location).
For domestic users, we recommend SSL certificates with localized OCSP. These certificates use domestic servers to verify the SSL certificate issuance status, which can significantly improve HTTPS access speed and provide more stable SSL certificate status queries, well meeting the security and performance requirements of various enterprises for SSL certificates. Currently, brands such as sslTrus, CFCA, Digicert, and GlobalSign support domestic OCSP query validation.
For details: Which SSL Certificate Brands Support Domestic OCSP?
How to Check the OCSP Address of a Certificate?
How can you check on an actual SSL certificate page whether the OCSP validation server address is international/global or domestic?
Please open the SSL certificate details page, or open the certificate details page on a website where an SSL certificate has already been installed. Different browsers display this in different forms, usually as a small lock icon. Here we use the Racent official website as an example: Racent Official Website. The browser used by the editor is 360 Browser.
As shown in the figure, in the [Authority Information Access] field, you can see the OCSP responder: URL: http://ocsp.sectigochina.com
Then you can determine the OCSP address by looking at the domain suffix. For example, .cn is domestic, .com is international, or you can query the IP location corresponding to the domain to find out the address of the validation server.