OCSPn

OCSPn is a term occasionally used in documentation to describe an extension or variation of the Online Certificate Status Protocol (OCSP) that employs a nonce in requests and responses to prevent replay attacks. It is not a separate, formal standard; rather, it refers to OCSP behavior that uses the nonce feature described in RFC-based OCSP specifications.

OCSP allows clients to query a certificate’s revocation status in real time. A client sends an OCSPRequest to an OCSP responder, and the responder replies with an OCSPResponse indicating the certificate status as good, revoked, or unknown. The nonce is an optional field that a client may include in the request; if the responder supports it, the response will carry the same nonce. This binding helps ensure the response is tied to the specific request and reduces the risk of replaying stale responses.

In practice, OCSPn-like behavior is used by modern browsers and TLS implementations to improve the freshness and integrity of revocation data. It complements other mechanisms such as OCSP stapling, which reduces network round-trips by delivering the status during TLS handshakes. However, not all responders implement nonce handling, and some deployments may prioritize privacy or performance considerations over strict nonce usage.

Security considerations include improved protection against replay attacks and better assurance of data freshness. Potential drawbacks include added bandwidth for including nonces and possible privacy implications because OCSP requests expose certificate usage patterns to responders. Proper implementation requires that nonces be generated randomly and handled correctly by both client and responder.

See also: OCSP, RFC 6960, OCSP stapling, certificate revocation.