What is a benefit of Online Certificate Status Protocol (OCSP)?

Question

Options

• AIt lets a device determine whether to trust a certificate without needing any root certificates
• BIt lets a device query whether a single certificate is revoked or not.
• CIt lets a device download all the serial numbers for certificates revoked by a CA at once.
• DIt lets a device dynamically renew its certificate before the certificate expires.

• A
  5% (2)
• B
  86% (38)
• C
  7% (3)
• D
  2% (1)

Explanation

OCSP is a protocol that allows a client to query a CA's OCSP responder with a single certificate's serial number and receive a real-time response of "good," "revoked," or "unknown" - making B correct. It was designed precisely to solve the inefficiency of downloading entire revocation lists for a single certificate check.

Why the distractors fail:

• A is wrong because OCSP still requires a trusted root certificate to verify the OCSP responder's signature - it doesn't bypass the trust chain.
• C describes CRL (Certificate Revocation List), not OCSP; CRLs are bulk downloads of all revoked serial numbers, which OCSP was created to replace for on-demand checks.
• D is wrong because OCSP has nothing to do with certificate renewal - that's handled by enrollment protocols like SCEP or EST.

Memory tip: Think of OCSP as a "spot check" - you ask about one certificate, right now. CRL = download the whole list; OCSP = check just one. The word "Online" in OCSP hints at real-time, single-query status checking.

No community discussion yet for this question.