Senior LevelWeb Security & Cyber Defense
How do CRLs and OCSP Stapling verify certificate revocation status without privacy leaks?
❓ Interview Prompt: Explain Certificate Revocation Lists (CRL), Online Certificate Status Protocol (OCSP), OCSP Stapling, and eliminating CA privacy leaks.
Revoking compromised X.509 digital certificates before expiration:
Revocation Methods:
1
CRL (Certificate Revocation List): Server downloads massive serial number lists. (Slow and inefficient).
2
OCSP (Online Certificate Status Protocol): Browser queries CA server directly. Privacy Flaw: CA learns every website the user visits!
3
OCSP Stapling (Best Practice): Web server fetches signed OCSP revocation status from CA periodically and "staples" it to the TLS handshake packet, guaranteeing privacy and fast TLS setup!
Code Implementation Example
http
// TLS Handshake response with OCSP Stapled Certificate Status:
OCSP Response Status: successful (0x0)
Cert Status: good
This Update: Jul 28 00:00:00 2026 GMT
Next Update: Aug 04 00:00:00 2026 GMT💡Inspecting OCSP Stapling response in TLS handshake.
🎯 Interview Key Takeaway
Enable OCSP Stapling on web servers to verify certificate revocation status while protecting user browsing privacy.
#OCSP Stapling#PKI#TLS#Certificates#Senior
Back to all Web Security & Cyber Defense Questions→