Glossary

OCSP

Online Certificate Status Protocol

A client asks a CA’s responder whether a certificate has been revoked, or the server staples a recent signed response to its handshake. It is now optional for publicly trusted TLS certificates, and Let’s Encrypt turned its responders off in 2025.

Defined in: RFC 6960

Covered in

Guide

Operate TLS and certificates: configuration, renewal and verification

Configure a modern TLS profile with hybrid post-quantum key exchange, automate renewal for certificate lifetimes that fall to 47 days, and verify every termination point with a fresh handshake.