Why OCSP beats waiting for a CRL

Certificate Revocation Lists work by publishing the full list of every revoked certificate a CA has ever issued, which a client downloads and checks against — a list that grows over a CA's lifetime and has to be periodically re-fetched in full. OCSP (Online Certificate Status Protocol) replaces that with a much narrower question: "is this one specific certificate, by serial number, still good?" — answered directly by the issuing CA's OCSP responder in real time, without needing the full revocation history. That's a meaningfully more current and more efficient check, which is why this tool queries OCSP directly rather than trying to download and search a CRL.

Why "no OCSP" is an increasingly normal result, not a failure

Several major CAs have been deliberately moving away from OCSP in recent years — Let's Encrypt sunset OCSP support in 2024 in favor of very short-lived certificates (which reduce the value of real-time revocation checking, since a compromised cert simply expires soon regardless) and CRLs. Seeing "no OCSP" on a certificate from one of these CAs reflects an intentional industry shift in how revocation is being handled, not a misconfiguration on the target's part — this tool reports it as a distinct, expected outcome rather than treating the absence of an OCSP URL as an error.

Why the OCSP responder connection gets the same SSRF protection as the target

The OCSP responder URL this tool connects to comes from a field inside the certificate the target server itself presents — meaning the target has some influence over where this tool connects next. Applying the same private/internal-address blocking to that responder connection that's applied to the host you enter directly closes off a potential trick where a malicious target embeds an internal address as its "OCSP responder" hoping this tool's server would blindly connect to it. That's the same SSRF-guard discipline this site applies everywhere a server-side connection is made based on user- or target-controlled input.