Practical Internet of Things Security - Second Edition

OCSP

Given the potential latency and the need to download large files, other mechanisms have evolved to provide more quickly revocation information over networks, most notably the Online Certificate Status Protocol (OCSP). OCSP is a client/server protocol that allows clients to simply ask a server whether a given public key credential is still valid. The OCSP server is typically responsible for the CA's Certificate Revocation List (CRL) and using it to generate an OCSP proof set (internally signed database of proofs). These sets are then used to generate OCSP response messages to the requesting clients. OCSP proof sets can be generated periodically for different time intervals.