OCSP
also: Online Certificate Status Protocol
Online Certificate Status Protocol (OCSP) is a method for checking whether an X.509 digital certificate has been revoked without downloading the entire Certificate Revocation List (CRL).
OCSP allows clients to query an OCSP responder server to verify the validity status of a certificate in real-time. Instead of periodically downloading large CRL files, a client sends a request containing the certificate serial number and issuer information, and the responder returns the certificate's status: valid, revoked, or unknown.
When you connect to an HTTPS website, your browser can use OCSP to check if the server's SSL/TLS certificate has been revoked by its certificate authority (CA). For example: openssl ocsp -issuer ca.crt -cert server.crt -url http://ocsp.example.com queries the OCSP responder to verify server.crt.
OCSP reduces network overhead compared to CRL checking and provides faster certificate validation. Many modern TLS implementations support OCSP Stapling, where the server itself fetches and caches the OCSP response, providing it directly to clients during the TLS handshake.