OPENSSL-OCSP(1ssl) OpenSSL OPENSSL-OCSP(1ssl) (NAME) openssl-ocsp - (Online Certificate Status Protocol) (SYNOPSIS) OCSP (OCSP Client) openssl ocsp [-help] [-out file] [-issuer file] [-cert file] [-no_certs] [-serial n] [-signer file] [-signkey file] [-sign_other file] [-nonce] [-no_nonce] [-req_text] [-resp_text] [-text] [-reqout filename] [-respout filename] [-reqin filename] [-respin filename] [-url URL] [-host host:port] [-path pathname] [-proxy [http[s]://][userinfo@]host[:port][/path][?query][#fragment]] [-no_proxy addresses] [-header] [-timeout seconds] [-VAfile file] [-validity_period n] [-status_age n] [-noverify] [-verify_other file] [-trust_other] [-no_intern] [-no_signature_verify] [-no_cert_verify] [-no_chain] [-no_cert_checks] [-no_explicit] [-port num] [-ignore_err] OCSP (OCSP Server) openssl ocsp [-index file] [-CA file] [-rsigner file] [-rkey file] [-passin arg] [-rother file] [-rsigopt nm:v] [-rmd digest] [-badsig] [-resp_no_certs] [-nmin n] [-ndays n] [-resp_key_id] [-nrequest n] [-multi process-count] [-rcid digest] [-digest] [-CAfile file] [-no-CAfile] [-CApath dir] [-no-CApath] [-CAstore uri] [-no-CAstore] [-allow_proxy_certs] [-attime timestamp] [-no_check_time] [-check_ss_sig] [-crl_check] [-crl_check_all] [-explicit_policy] [-extended_crl] [-ignore_critical] [-inhibit_any] [-inhibit_map] [-partial_chain] [-policy arg] [-policy_check] [-policy_print] [-purpose purpose] [-suiteB_128] [-suiteB_128_only] [-suiteB_192] [-trusted_first] [-no_alt_chains] [-use_deltas] [-auth_level num] [-verify_depth num] [-verify_email email] [-verify_hostname hostname] [-verify_ip ip] [-verify_name name] [-x509_strict] [-issuer_checks] [-provider name] [-provider-path path] [-provparam [name:]key=value] [-propquery propq] (DESCRIPTION) (OCSP) () (RFC 2560). OCSP . OCSP OCSP . (OPTIONS) . . OCSP (OCSP Client Options) -help . -out filename . -issuer filename . PEM DER PKCS#12 . . -cert . -cert filename filename . PEM DER PKCS#12 . . -issuer . -no_certs . -serial num -cert num . "0x" . "-" . -signer filename, -signkey filename OCSP -signer -signkey. PEM DER PKCS#12 . -signkey . OCSP . -sign_other filename . PEM DER PKCS#12 . -nonce, -no_nonce (nonce) OCSP OCSP. OCSP -reqin : -nonce . OCSP ( -cert -serial) -no_nonce . -req_text, -resp_text, -text OCSP . -reqout file, -respout filename OCSP DER filename. . / . (truncate) . -reqin file, -respin filename OCSP file. OCSP ( -serial -cert -host) . -url responder_url () URL. HTTP HTTPS (SSL/TLS) . userinfo fragment . query (path) . -host -path . -host host:port, -path pathname -host OCSP host port . host IP ( ) 127.0.0.1 "[::1]" localhost. IPv6 "[" "]" . -path HTTP "/" . -url http:// host port pathname . -proxy [http[s]://][userinfo@]host[:port][/path][?query][#fragment] HTTP(S) OCSP -no_proxy ( ). IPv6 "[" "]" . "https" "http://" "https://" userinfo path query fragment . "http_proxy" TLS "HTTP_PROXY" TLS "https_proxy" "HTTPS_PROXY" . -no_proxy addresses IP / DNS HTTP(S) / ( "..." ). "no_proxy" "NO_PROXY" . -header name=value name value OCSP . . -timeout seconds OCSP . POSIX OCSP . . -verify_other file URI OCSP. : . PEM DER PKCS#12 . -trust_other -verify_other . CA . -VAfile file URI . -verify_other -trust_other . PEM DER PKCS#12 . -noverify OCSP . . -no_intern OCSP . -verify_other -VAfile . -no_signature_verify OCSP . OCSP . -no_cert_verify OCSP . OCSP . -no_chain CA . -no_explicit CA OCSP . -no_cert_checks OCSP . . -validity_period nsec, -status_age age ( ) OCSP . notBefore notAfter . . OCSP . -validity_period . notAfter . notBefore age . . -rcid digest OCSP . openssl-dgst(1) . . -digest OCSP . dgst OpenSSL . SHA-1 . . -CAfile file, -no-CAfile, -CApath dir, -no-CApath, -CAstore uri, -no-CAstore << >> openssl-verification-options(1) . -allow_proxy_certs, -attime, -no_check_time, -check_ss_sig, -crl_check, -crl_check_all, -explicit_policy, -extended_crl, -ignore_critical, -inhibit_any, -inhibit_map, -no_alt_chains, -partial_chain, -policy, -policy_check, -policy_print, -purpose, -suiteB_128, -suiteB_128_only, -suiteB_192, -trusted_first, -use_deltas, -auth_level, -verify_depth, -verify_email, -verify_hostname, -verify_ip, -verify_name, -x509_strict -issuer_checks . << >> openssl-verification-options(1) . -provider name -provider-path path -provparam [name:]key=value -propquery propq << >> openssl(1) provider(7) property(7) . OCSP (OCSP Server Options) -index indexfile indexfile ca . -index . ( -issuer -serial) ( -reqin) OCSP ( -port -url ). -index -CA -rsigner . -CA file CA -index . PEM DER PKCS#12 . -rsigner file OCSP. PEM DER PKCS#12 . -rkey file OCSP -rsigner . -passin arg . arg openssl-passphrase-options(1) . -rother file OCSP. PEM DER PKCS#12 . -rsigopt nm:v OCSP. . -rmd digest . -badsig . -resp_no_certs OCSP . -resp_key_id (key ID) (subject name) . -port portnum OCSP . IPv4 IPv6 . -url . 0 . -ignore_err : OCSP . OCSP . -nrequest number OCSP number . -multi process-count OCSP (respawn) . CA . -timeout OCSP . POSIX ( fork() ) . -nmin minutes, -ndays days : nextUpdate . nextUpdate . OCSP (OCSP RESPONSE VERIFICATION) OCSP RFC 2560 . OCSP OCSP . OCSP . -CAfile -CApath -CAstore OpenSSL . OCSP . CA OCSP : OCSP . CA OCSP CA . OCSPSigning OCSP OCSP . -no_explicit CA CA OCSP OCSP . OCSP . OCSP . OCSP CA ( ) . OCSP << >> (global responder) CA CA OCSP . : openssl x509 -in ocspCA.pem -addtrust OCSPSigning -out trustedCA.pem -VAfile . (NOTES) . -CApath -CAfile -CAstore ( <>> ) -VAfile . OCSP : OCSP . HTTP POST OCSP . . . CGI -reqin -respout . (EXAMPLES) OCSP : openssl ocsp -issuer issuer.pem -cert c1.pem -cert c2.pem -reqout req.der OCSP http://ocsp.myhost.com : openssl ocsp -issuer issuer.pem -cert c1.pem -cert c2.pem \ -url http://ocsp.myhost.com/ -resp_text -respout resp.der OCSP : openssl ocsp -respin resp.der -text -noverify OCSP ca . . openssl ocsp -index demoCA/index.txt -port 8888 -rsigner rcert.pem -CA demoCA/cacert.pem -text -out log.txt : openssl ocsp -index demoCA/index.txt -port 8888 -rsigner rcert.pem -CA demoCA/cacert.pem -nrequest 1 : openssl ocsp -index demoCA/index.txt -rsigner rcert.pem -CA demoCA/cacert.pem -issuer demoCA/cacert.pem -serial 1 : openssl ocsp -index demoCA/index.txt -rsigner rcert.pem -CA demoCA/cacert.pem -reqin req.der -respout resp.der (HISTORY) -no_alt_chains OpenSSL 1.1.0 . (COPYRIGHT) Copyright 2001-2023 The OpenSSL Project Authors. All Rights Reserved. Apache . (<<>>) . . LICENSE . 3.6.4 2026-08-25 OPENSSL-OCSP(1ssl)