Deployment – OCSPResponder is delivered as a single, statically linked binary without external runtime dependencies. Pre-built binaries are available for Linux, Windows and macOS. A Docker image is provided for container-based deployments and orchestration platforms.
Offline mode architecture – In offline mode, OCSPResponder is split into two components. The Generator is a command-line tool that is executed periodically (e.g. via cron or a scheduler). It reads the complete certificate status data, computes a signed OCSP response for each entry using the corresponding OCSP signer key, and stores the results in the database. The Server is a permanently running network service that receives incoming OCSP requests, extracts the issuing CA and serial number from each request, looks up the corresponding pre-computed response and returns it to the client. Pre-computed responses cannot by design contain a nonce.
Online mode architecture – In online mode, only the server component is used. It accepts OCSP requests on a network socket and delegates each request to the internal signer, which determines the certificate status from the database and generates a signed OCSP response. If the client request contains a nonce, it is embedded in the response.
Performance – OCSPResponder is designed for speed. In offline mode, pre-computed responses are cached in memory, enabling lookup times in the sub-millisecond range. Even on modest hardware, throughput easily reaches thousands of requests per second. Memory consumption is typically in the range of 100–200 MB, even under sustained high load – resource consumption is negligible in most deployment scenarios.
Monitoring – OCSPResponder provides performance and operational metrics in Prometheus format, enabling integration into common monitoring and alerting stacks such as Prometheus/Grafana.
Key storage options – Private OCSP signer keys can be stored as files on disk, imported into the OCSPResponder database, or held in a hardware security module accessible via PKCS#11. Multiple signer certificates can be configured per issuing CA; OCSPResponder automatically selects the most current valid signer for response generation.
Failover: Support for common load balancers and reverse proxies.
