wireshark https status code from website

This enables extensive customization to a particular PKI scheme. The OCSP request format supports additional extensions. If it cannot process the request, it may return an error code. Bob completes the transaction with Alice.Īn OCSP responder (a server typically run by the certificate issuer) may return a signed response signifying that the certificate specified in the request is 'good', 'revoked', or 'unknown'.

Bob uses Carol's public key to verify Carol's response. Bob has stored Carol's public key sometime before this transaction. Bob cryptographically verifies Carol's signed response.Carol's OCSP responder confirms that Alice's certificate is still OK, and returns a signed, successful 'OCSP response' to Bob.In this scenario, Carol's CA database is the only trusted location where a compromise to Alice's certificate would be recorded. The OCSP responder looks in a CA database that Carol maintains. The OCSP responder uses the certificate serial number to look up the revocation status of Alice's certificate. Carol's OCSP responder reads the certificate serial number from Bob's request.Bob, concerned that Alice's private key may have been compromised, creates an 'OCSP request' that contains Alice's certificate serial number and sends it to Carol.

Alice wishes to perform a transaction with Bob and sends him her public key certificate.

Alice and Bob have public key certificates issued by Carol, the certificate authority (CA).

OCSP does not mandate encryption, so other parties may intercept this information.

OCSP discloses to the responder that a particular network host used a particular certificate at a particular time.

Since an OCSP response has less data to parse, the client-side libraries that handle it can be less complex than those that handle CRLs.

Since an OCSP response contains less data than a typical certificate revocation list (CRL), it puts less burden on network and client resources.

Wireshark https status code from website