OCSP 证书状态查询

1. 概览

• 终端实体证书：vpn.example.com
• 签发 CA：AAA Issuing CA 01
• OCSP 请求方式：openssl ocsp 生成 DER 请求，curl POST 到 OCSP 服务
• OCSP 地址：http://10.0.0.5:8080/spki/ocsp
• 请求特点：-no_nonce
• 响应结果：
  • 有效响应：Cert Status: good
  • 吊销后响应：Cert Status: revoked

---

2. 终端实体证书

# 证书
-----BEGIN CERTIFICATE-----
MIIEADCCA6agAwIBAgIQfJ3udSuwCms7NU5DDgyvNTAKBggqhkjOPQQDBDBRMQsw
CQYDVQQGEwJDTjEUMBIGA1UEChMLUHJpdmF0ZVNpZ24xEDAOBgNVBAsTB0lzc3Vp
bmcxGjAYBgNVBAMTEUFBQSBJc3N1aW5nIENBIDAxMB4XDTI2MTAxNjE0NDYzM1oX
DTI3MTAxNjE0NTEzM1owSzELMAkGA1UEBhMCQ04xFDASBgNVBAoTC1ByaXZhdGVT
aWduMQwwCgYDVQQLEwNXZWIxGDAWBgNVBAMTD3Zwbi5leGFtcGxlLmNvbTCCASIw
DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALJGuDBqHh3EXYgMnxru9WplG6bz
U5G2eu8c4cQs7pkuKAOFrWt2+0DAccRPvsfRQKXSLyoGvCfsbf9IB0iY01ph6+0x
1D6VWEabd99zaLMxw3cEmcE2f3ZIKg8DcrhFgnYh1UuiPfJfu2+EHlf65VyGjAiA
q/DXsTsmF1G9evYHRl7WvySfvwOSohNvZFT2eASDt4ecb0y3PuGJ9OlrM1EusC1V
tTmM8ozjSdgCLCuWUjvvNI1IPetqidHPtTKONaJ/s+D41YicoIKI0CuKapHmzcVP
crmyAUXw8UW1RQl23ZroExmOWiMAJ65gZoV3N/CU89xD6B+NK3xYYCoTzmsCAwEA
AaOCAZkwggGVMA4GA1UdDwEB/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDAQYI
KwYBBQUHAwIwDAYDVR0TAQH/BAIwADApBgNVHQ4EIgQgzih83azmLDIB7sArUXXM
fXvSID5P8TAQOsSVDD7wtHkwKwYDVR0jBCQwIoAgQ5ZS1a1GA7jtEAvhDpizjN7V
RjjtfZppKa9x9oRWktQwYwYIKwYBBQUHAQEEVzBVMCMGCCsGAQUFBzABhhdodHRw
Oi8vb2NzcC5leGFtcGxlLmNvbTAuBggrBgEFBQcwAoYiaHR0cDovL2NhLmV4YW1w
bGUuY29tL2ludGVyMDAxLmNydDBjBgNVHREEXDBagg92cG4uZXhhbXBsZS5jb22C
D3d3dy5leGFtcGxlLmNvbYERYWRtaW5AZXhhbXBsZS5jb22HBMCoAQqGHXNwaWZm
ZTovL2V4YW1wbGUub3JnL3dvcmtsb2FkMDQGA1UdHwQtMCswKaAnoCWGI2h0dHA6
Ly9jcmwuZXhhbXBsZS5jb20vaW50ZXIwMDEuY3JsMAoGCCqGSM49BAMEA0gAMEUC
IQD6+MbSuT/4QNCySB1I281pOpFyIkboqs9KzLY5YBQ1+wIgBdDIPpl2cakDBnEi
LaTQaTP+oyDB3AMrFAZPBGOTRlc=
-----END CERTIFICATE-----

3. 签发 CA 证书

# CA
-----BEGIN CERTIFICATE-----
MIIC6jCCAdKgAwIBAgIRAKkXJo9jJ4jKlHaD8Lcsr54wDQYJKoZIhvcNAQELBQAw
WzELMAkGA1UEBhMCQ04xFDASBgNVBAoTC1ByaXZhdGVTaWduMRQwEgYDVQQLEwtQ
cml2YXRlU2lnbjEgMB4GA1UEAxMXQUFBIFByaXZhdGUgU2lnbiBSb290IENBMB4X
DTI2MTAxNjE1MDQwMFoXDTI3MTAxNjE1MDkwMFowUTELMAkGA1UEBhMCQ04xFDAS
BgNVBAoTC1ByaXZhdGVTaWduMRAwDgYDVQQLEwdJc3N1aW5nMRowGAYDVQQDExFB
QUEgSXNzdWluZyBDQSAwMTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABCTvYi6f
UwcATw7SAV51tgUww1+M4CKiK/xFHnIAyJ3+gUwyANH5mD97quSYbhYBoqXRk7FH
z2sXk8ExexEQNvyjfjB8MA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/
AgEAMCkGA1UdDgQiBCBDllLVrUYDuO0QC+EOmLOM3tVGOO19mmkpr3H2hFaS1DAr
BgNVHSMEJDAigCCHbHXgvOkfVFNYYb1TuFq8k/bEk3zAQkIUQazXnp+MfjANBgkq
hkiG9w0BAQsFAAOCAQEArgC1ZcZI8Xp891f4fvc6F7msPvCizgut+baPzdLbn8Bc
avB0TT8xcMbWSoNlkLTT0bJNuzTjkqLK2ALjLF7wzNZJ4bloup3bdeytR0KYQGED
IDJ/uHK0YXl1faSbTJb3ngi1dIKH6XZMEGvllARn0qc4wyGl9aRAc57JXxzWwygv
VLRIAgtrtwbh3Sw5cXKE/ggEL+rgX0WvkX/IyEC4B/MJZoTqyphxcRR0KLBx0htn
bRHw3gWrk1Lj/sfrmCoHWYlcLzL6gacZzetUzDXPO6stbUki+iT+VGox5qVqpEhk
TXuERqkjltOAAshtLS72/QfxT+oRmnRTC8AXJLGW
-----END CERTIFICATE-----

4. 生成 OCSP 请求

openssl ocsp -issuer issuer.pem -cert cert.pem -reqout ocsp_req.der -no_nonce

5. 查看 OCSP 请求内容

[root@iZ2ze19ijurr8l2qu7546kZ ~]# openssl ocsp -reqin ocsp_req.der -text -noverify
OCSP Request Data:
    Version: 1 (0x0)
    Requestor List:
        Certificate ID:
          Hash Algorithm: sha1
          Issuer Name Hash: D7F4A2D773F4E017FBDBA17CA86C6E8682ECDF47
          Issuer Key Hash: 2AA03A60D867641D91179A50FE5F9FE886312612
          Serial Number: 7C9DEE752BB00A6B3B354E430E0CAF35

6. 发送 OCSP 请求

curl -X POST \
  --data-binary @ocsp_req.der \
  -H "Content-Type: application/ocsp-request" \
  http://10.0.0.5:8080/spki/ocsp \
  -o ocsp_resp.der

7. DER 响应转 PEM

# 转pem
(echo "-----BEGIN OCSP RESPONSE-----"; base64 --wrap=64 ocsp_resp.der; echo "-----END OCSP RESPONSE-----")

8. 证书有效时的 OCSP 响应

# 证书有效
[root@iZ2ze19ijurr8l2qu7546kZ ~]# openssl ocsp -respin ocsp_resp.der -resp_text -noverify
OCSP Response Data:
    OCSP Response Status: successful (0x0)
    Response Type: Basic OCSP Response
    Version: 1 (0x0)
    Responder Id: C = CN, O = PrivateSign, OU = Issuing, CN = AAA Issuing CA 01
    Produced At: Oct 19 04:43:00 2026 GMT
    Responses:
    Certificate ID:
      Hash Algorithm: sha1
      Issuer Name Hash: D7F4A2D773F4E017FBDBA17CA86C6E8682ECDF47
      Issuer Key Hash: 2AA03A60D867641D91179A50FE5F9FE886312612
      Serial Number: 7C9DEE752BB00A6B3B354E430E0CAF35
    Cert Status: good
    This Update: Oct 19 04:43:15 2026 GMT
    Next Update: Oct 20 04:43:15 2026 GMT

    Signature Algorithm: ecdsa-with-SHA256
         30:46:02:21:00:f1:4b:01:aa:0b:13:fe:03:c6:93:28:6a:17:
         ff:a7:14:96:00:88:d9:6e:d8:2a:0c:c7:14:e8:a6:33:2b:d6:
         61:02:21:00:d9:70:84:f0:97:98:37:f9:7c:cb:27:42:6a:90:
         ee:53:2d:d5:fc:85:d8:e8:f5:04:98:dc:bf:63:ee:51:d2:33

9. 证书吊销后的 OCSP 响应

# 吊销后
[root@iZ2ze19ijurr8l2qu7546kZ ~]# openssl ocsp -respin r_ocsp_resp.der -resp_text -noverify
OCSP Response Data:
    OCSP Response Status: successful (0x0)
    Response Type: Basic OCSP Response
    Version: 1 (0x0)
    Responder Id: C = CN, O = PrivateSign, OU = Issuing, CN = AAA Issuing CA 01
    Produced At: Oct 19 05:01:00 2026 GMT
    Responses:
    Certificate ID:
      Hash Algorithm: sha1
      Issuer Name Hash: D7F4A2D773F4E017FBDBA17CA86C6E8682ECDF47
      Issuer Key Hash: 2AA03A60D867641D91179A50FE5F9FE886312612
      Serial Number: 7C9DEE752BB00A6B3B354E430E0CAF35
    Cert Status: revoked
    Revocation Time: Oct 19 04:47:31 2026 GMT
    This Update: Oct 19 05:01:21 2026 GMT
    Next Update: Oct 20 05:01:21 2026 GMT

    Signature Algorithm: ecdsa-with-SHA256
         30:45:02:21:00:9c:5c:96:6b:f6:ee:36:60:55:49:97:41:68:
         c6:b4:0a:eb:fc:27:7e:bd:74:b3:ef:99:ad:b7:33:6d:05:d3:
         5a:02:20:48:09:21:6d:ef:fc:dd:30:6b:01:cf:db:07:7c:05:
         4e:df:d3:61:87:70:5d:c1:13:13:86:41:b7:52:cb:3a:8e

OCSP响应，本身为二进制流，此处转换后保留学习，将其分别保存成文件，使用命令转回二进制流

openssl base64 -d -in ocsp_resp.pem -out ocsp_resp.der

# 证书有效
-----BEGIN OCSP RESPONSE-----
MIIBUwoBAKCCAUwwggFIBgkrBgEFBQcwAQEEggE5MIIBNTCB26FTMFExCzAJBgNV
BAYTAkNOMRQwEgYDVQQKEwtQcml2YXRlU2lnbjEQMA4GA1UECxMHSXNzdWluZzEa
MBgGA1UEAxMRQUFBIElzc3VpbmcgQ0EgMDEYDzIwMjYxMDE5MDQ0MzAwWjBzMHEw
STAJBgUrDgMCGgUABBTX9KLXc/TgF/vboXyobG6GguzfRwQUKqA6YNhnZB2RF5pQ
/l+f6IYxJhICEHyd7nUrsAprOzVOQw4MrzWAABgPMjAyNjEwMTkwNDQzMTVaoBEY
DzIwMjYxMDIwMDQ0MzE1WjAKBggqhkjOPQQDAgNJADBGAiEA8UsBqgsT/gPGkyhq
F/+nFJYAiNlu2CoMxxTopjMr1mECIQDZcITwl5g3+XzLJ0JqkO5TLdX8hdjo9QSY
3L9j7lHSMw==
-----END OCSP RESPONSE-----

# 这是吊销后的响应PEM内容
-----BEGIN OCSP RESPONSE-----
MIIBZQoBAKCCAV4wggFaBgkrBgEFBQcwAQEEggFLMIIBRzCB7qFTMFExCzAJBgNV
BAYTAkNOMRQwEgYDVQQKEwtQcml2YXRlU2lnbjEQMA4GA1UECxMHSXNzdWluZzEa
MBgGA1UEAxMRQUFBIElzc3VpbmcgQ0EgMDEYDzIwMjYxMDE5MDUwMTAwWjCBhTCB
gjBJMAkGBSsOAwIaBQAEFNf0otdz9OAX+9uhfKhsboaC7N9HBBQqoDpg2GdkHZEX
mlD+X5/ohjEmEgIQfJ3udSuwCms7NU5DDgyvNaERGA8yMDI2MTAxOTA0NDczMVoY
DzIwMjYxMDE5MDUwMTIxWqARGA8yMDI2MTAyMDA1MDEyMVowCgYIKoZIzj0EAwID
SAAwRQIhAJxclmv27jZgVUmXQWjGtArr/Cd+vXSz75mttzNtBdNaAiBICSFt7/zd
MGsBz9sHfAVO39Nhh3BdwRMThkG3Uss6jg==
-----END OCSP RESPONSE-----

打赏