OCSP results explained: good, revoked, unknown and unavailable
An OCSP result answers a narrower question than “is this certificate safe to use?” Use the certificate and its direct issuer to query status, then read the response alongside expiry and trust checks.
Open the OCSP checkerSupply the certificate and its direct issuer
Paste the server certificate as a complete PEM block. In the issuer field, paste the CA certificate that directly issued it, usually an intermediate CA rather than the root. Obtain it from your CA or deployment bundle. If using the optional chain field instead, put that direct issuer first: this tool uses only the first certificate, and only when the issuer field is empty.
Read the status without over-interpreting it
good is the responder’s positive status, not proof that the certificate is trusted, within its validity period or correct for a hostname. revoked means the responder reports revocation; consult the issuing CA before continuing to use that certificate. unknown means the responder cannot establish its status. Check the issuer and certificate pair rather than treating unknown as revoked or good.
No OCSP URL in certificate
The tool displays unavailable when the certificate has no OCSP responder URL. No query was made, so this is not a revocation verdict. Look at the CA’s published revocation method and any CRL distribution URLs. This tool lists CRL URLs only; it does not download a CRL or check whether the serial number appears in it.
Issuer required, network errors and timeouts
An issuer-required message means the server certificate was readable but a direct issuer was missing for the query. If both are present and the query fails, read the response text for a connection or responder error. A failed request cannot establish revocation status. Retry after checking the CA’s service status and that the certificates belong together.
This Update and Next Update
This Update describes when the reported status was known to be correct; Next Update indicates when newer information is expected. They are response times, not the certificate’s expiry dates. A missing Next Update does not itself mean revocation. Check freshness and the certificate’s validity separately.
Use this as a diagnostic, not a trust decision
The server sends an OCSP request to the URL in the supplied certificate. No private key is needed. This checker does not verify the response signature or the certificate trust chain. For a deployment decision, use a client that validates signatures, trust, freshness and hostname, and follow the CA’s guidance.