OCSPCHECK(8)

💅 OCSPCHECK(8) — the "is this cert still valid bestie" check

okay so real talk, this is ocspcheck from section 8 of the System Manager's Manual, and she's here to ask an OCSP responder if a certificate is still valid. no cap. let's get into it 💖

---

✨ NAME ✨

ocspcheck — check a certificate for validity against its OCSP responder 🎀

---

🌸 SYNOPSIS 🌸

ocspcheck [-Nv] [-C CAfile] [-i staplefile] [-o staplefile] file

---

🦋 DESCRIPTION 🦋

The ocspcheck utility validates a PEM format certificate against the OCSP responder encoded in the certificate specified by the file argument. That's the whole vibe. ✨

Normally it should be used for checking server certificates and maintaining saved OCSP responses to be used for OCSP stapling. like, that's her moment to shine, that's her main character energy 👑

The options are as follows:

---

💅 OPTIONS 💅

• -C CAfile — Tell her which PEM format root certificate bundle to use for the validation of requests. By default no certificates are used beyond those in the certificate chain provided by the file argument. so like, no extra trust anchors unless you hand her some 🫶
• -i staplefile — Give her an input filename to read a DER-encoded OCSP response from, instead of fetching it from the OCSP server. A filename of - will read the response from standard input. very "don't talk to the server, just read the file" of you 🙈
• -N — Do not use a nonce value in the OCSP request, or validate that the nonce was returned in the OCSP response. By default a nonce is always used and validated when retrieving a response from an OCSP server.

⚠️ SECURITY RISK ALERT ⚠️ the use of this flag is a security risk as it will allow OCSP responses to be replayed. It should not be used unless the OCSP server does not support the use of OCSP nonces. fr fr, only if you have literally no other choice 💀

• -o staplefile — Specify an output filename where the DER encoded response from the OCSP server will be written, if the OCSP response validates. A filename of - will write the response to standard output. By default the response is not saved. no file, no stress 🎀
• -v — Increase verbosity. This flag may be specified multiple times to get more verbose output. The default behaviour is to be silent unless something goes wrong. she's lowkey quiet by default, iconic 😌

---

🔥 EXIT STATUS 🔥

The ocspcheck utility exits 0 if the OCSP response validates for the certificate in file and all output is successfully written out.

ocspcheck exits >0 if an error occurs or the OCSP response fails to validate. not the slay we wanted 😭

---

🌈 SEE ALSO 🌈

nc(1), tls_config_set_ocsp_staple_file(3), tls_config_set_ocsp_staple_mem(3), httpd(8)

---

⭐ STANDARDS ⭐

X.509 Internet Public Key Infrastructure Online Certificate Status Protocol, RFC 6960. yes bestie, there's a whole RFC for this and she respects it 📜

---

🧚 HISTORY 🧚

The ocspcheck utility first appeared in OpenBSD 6.1. a certified vintage ✨

---

👑 AUTHORS 👑

ocspcheck was written by Bob Beck. thank you Bob, king behavior 🫶

---

💜 CAVEATS 💜

While ocspcheck could possibly be used in scripts to query responders for server certificates seen on client connections, this is almost always a bad idea. God kills a kitten every time you make an OCSP query from the client side of a TLS connection. 🐱💀 like she said what she said, do NOT do this bestie

---

🍓 BUGS 🍓

ocspcheck will create the output file if it does not exist. On failure a newly created output file will not be removed. so if it flops, that little file is just... still there. living its life. 🙈

---

okay that's the whole page!! this was ocspcheck(8) from the Debian edition, dated September 17, 2026 — go validate those certs responsibly, mwah 💋✨🎀