OCSPCHECK(8)

💅 OCSPCHECK(8) — like, the ocspcheck utility, bestie

okay so real talk, this is ocspcheck from section 8 of the System Manager's Manual (that's the System Manager's Manual, not the regular one, iykyk) and it's genuinely one of those tools that sounds boring but is actually lowkey iconic ✨

---

🌸 NAME 🌸

ocspcheck — check a certificate for validity against its OCSP responder

---

🎀 SYNOPSIS 🎀

ocspcheck [-Nv] [-C CAfile] [-i staplefile] [-o staplefile] file

---

💖 DESCRIPTION 💖

so the ocspcheck utility validates a PEM format certificate against the OCSP responder encoded in the certificate specified by the file argument. periodt. 🫶

normally you'd use it for checking server certificates and for maintaining saved OCSP responses to be used for OCSP stapling. that's the whole vibe check.

the options are as follows:

✨ OPTIONS ✨

• -C CAfile — specify a PEM format root certificate bundle to use for the validation of requests. by default, no certificates are used beyond those in the certificate chain provided by the file argument. no extra credit, just the chain you brought. 💅
• -i staplefile — specify an input filename from which a DER-encoded OCSP response will be read instead of fetching it from the OCSP server. a filename of - will read the response from standard input. v convenient, ngl.
• -N — do not use a nonce value in the OCSP request, or validate that the nonce was returned in the OCSP response. by default a nonce is always used and validated when retrieving a response from an OCSP server. 🚨 the use of this flag is a security risk as it will allow OCSP responses to be replayed. it should not be used unless the OCSP server does not support the use of OCSP nonces. like, fr fr, be careful with this one, bestie.
• -o staplefile — specify an output filename where the DER encoded response from the OCSP server will be written, if the OCSP response validates. a filename of - will write the response to standard output. by default the response is not saved. main character response, just not stored anywhere 🙈
• -v — increase verbosity. this flag may be specified multiple times to get more verbose output. the default behaviour is to be silent unless something goes wrong. she's quiet until it's tea time ☕

---

🔥 EXIT STATUS 🔥

the ocspcheck utility exits 0 if the OCSP response validates for the certificate in file and all output is successfully written out. 🎉

ocspcheck exits >0 if an error occurs or the OCSP response fails to validate. 😭 not the slay we wanted.

---

🦋 SEE ALSO 🦋

nc(1), tls_config_set_ocsp_staple_file(3), tls_config_set_ocsp_staple_mem(3), httpd(8)

---

🌈 HISTORY 🌈

the ocspcheck utility first appeared in OpenBSD 6.1. a legend was born 👑

---

👑 AUTHORS 👑

ocspcheck was written by Bob Beck. ty king 🫶

---

💀 CAVEATS 💀

while ocspcheck could possibly be used in scripts to query responders for server certificates seen on client connections, this is almost always a bad idea. 💀

God kills a kitten every time you make an OCSP query from the client side of a TLS connection.

not me warning you about the kittens 😭 protect them at all costs 🐱💔

---

🙈 BUGS 🙈

ocspcheck will create the output file if it does not exist. on failure a newly created output file will not be removed. so like... it leaves its mess behind sometimes, that's just how she is 🫠

---

⭐ and that's the whole page bestie 💜 this beauty is from Debian, dated November 29, 2017 — a vintage icon, we stan a timeless queen 🎀✨