# How to Test OCSP Stapling and Certificate Revocation Status with testssl.sh

> Easily test OCSP stapling and certificate revocation status with testssl.sh. This powerful tool checks external OCSP responders and CRLs for accurate validation directly from TLS handshakes.

- Repository: [Dirk Wetter/testssl.sh](https://github.com/drwetter/testssl.sh)
- Tags: how-to-guide
- Published: 2026-03-01

---

**[`testssl.sh`](https://github.com/drwetter/testssl.sh/blob/main/testssl.sh) extracts OCSP stapling data directly from TLS handshakes and validates certificate revocation status through external OCSP responders and CRLs when network queries are enabled.**

The [`drwetter/testssl.sh`](https://github.com/drwetter/testssl.sh/blob/main/drwetter/testssl.sh) repository provides a comprehensive command-line tool for auditing TLS/SSL configurations, including automated detection of OCSP stapling and certificate revocation validation. By analyzing raw TLS records and optionally querying certificate authorities, you can verify both server-side stapling support and the current revocation state of certificates in the chain.

## Detecting OCSP Stapling in testssl.sh

When [`testssl.sh`](https://github.com/drwetter/testssl.sh/blob/main/testssl.sh) completes a TLS handshake, it inspects the server response for stapled OCSP data. The script initializes the **`STAPLED_OCSP_RESPONSE`** variable at line 333 of [`testssl.sh`](https://github.com/drwetter/testssl.sh/blob/main/testssl.sh) to store raw response bytes extracted during the handshake parsing phase.

### Extracting the Stapled Response

After the TLS connection completes, the script parses the TLS dump between lines 8406 and 8450 to locate any OCSP response bytes. According to the source code in [`testssl.sh`](https://github.com/drwetter/testssl.sh/blob/main/testssl.sh), the extraction process captures the stapled data and populates the `STAPLED_OCSP_RESPONSE` variable for subsequent analysis.

### Validating OCSP Response Status

The script reports OCSP stapling findings in the dedicated output section spanning lines 10197-10218. If the stapled response contains an error status—indicating an invalid or malformed response—the script marks the test with a **WARN** status and records the specific error condition at lines 10215-10216. This allows immediate identification of servers providing defective stapling data.

## Verifying Certificate Revocation Status

By default, [`testssl.sh`](https://github.com/drwetter/testssl.sh/blob/main/testssl.sh) operates in a passive mode that parses certificates without contacting external servers. Active revocation checking requires explicit permission to initiate network connections to OCSP responders and CRL distribution points.

### Enabling External Network Queries

To perform active revocation checks, supply the **`--phone-out`** flag or set the environment variable **`PHONE_OUT=true`**. As documented in [`doc/testssl.1.md`](https://github.com/drwetter/testssl.sh/blob/main/doc/testssl.1.md) at line 155, this switch enables the helper script [`utils/checkcert.sh`](https://github.com/drwetter/testssl.sh/blob/main/utils/checkcert.sh) to download Certificate Revocation Lists (CRLs) and query OCSP responders listed in the certificate's Authority Information Access extension.

### OCSP Responder and CRL Verification

When `--phone-out` is active, [`utils/checkcert.sh`](https://github.com/drwetter/testssl.sh/blob/main/utils/checkcert.sh) executes the OCSP query logic between lines 285-300. The script contacts the OCSP URI embedded in the certificate and evaluates the revocation status. The final report presents three distinct findings:

- **OCSP stapling** – Whether the server provides a stapled response
- **OCSP must staple** – Whether the certificate contains the OCSP Must-Staple extension
- **CRL/OCSP** – The revocation status according to active online checks

### Proxy Configuration Considerations

OCSP checks are automatically skipped when a proxy is configured unless you explicitly set **`IGN_OCSP_PROXY=true`**. The proxy detection logic at line 2155 of [`testssl.sh`](https://github.com/drwetter/testssl.sh/blob/main/testssl.sh) prevents external revocation queries through proxy tunnels by default, ensuring the script does not leak certificate information through intermediary servers unintentionally.

## Practical Command Examples

Run these commands to evaluate OCSP stapling and revocation status across different network configurations:

```bash

# Basic OCSP stapling detection (no external network calls)

./testssl.sh --ocsp example.com

```

```bash

# Full revocation check including CRL and OCSP queries

./testssl.sh --phone-out --ocsp example.com

```

```bash

# Force OCSP verification through a configured proxy

IGN_OCSP_PROXY=true ./testssl.sh --phone-out --ocsp example.com

```

The `--ocsp` flag serves as a shortcut to display the OCSP stapling section in the output, while `--phone-out` controls whether [`testssl.sh`](https://github.com/drwetter/testssl.sh/blob/main/testssl.sh) invokes [`utils/checkcert.sh`](https://github.com/drwetter/testssl.sh/blob/main/utils/checkcert.sh) for external revocation verification.

## Summary

- **[`testssl.sh`](https://github.com/drwetter/testssl.sh/blob/main/testssl.sh)** detects OCSP stapling by parsing TLS handshake data and storing raw responses in the `STAPLED_OCSP_RESPONSE` variable during execution.
- **Error states** in stapled responses trigger a WARN status at lines 10215-10216 of the main script, alerting you to defective server configurations.
- **Active revocation checks** require the `--phone-out` flag to enable [`utils/checkcert.sh`](https://github.com/drwetter/testssl.sh/blob/main/utils/checkcert.sh) to query OCSP responders and download CRLs from Authority Information Access URLs.
- **Proxy environments** block OCSP queries by default; set `IGN_OCSP_PROXY=true` to override this security behavior.
- The tool generates three separate report items: OCSP stapling support, Must-Staple extension presence, and active revocation status via CRL/OCSP.

## Frequently Asked Questions

### What is the difference between OCSP stapling and OCSP must-staple?

**OCSP stapling** refers to the server including a signed OCSP response within the TLS handshake to improve performance and privacy. **OCSP must-staple** is a certificate extension that mandates the server must staple a valid OCSP response; if the server fails to provide stapling when this extension is present, [`testssl.sh`](https://github.com/drwetter/testssl.sh/blob/main/testssl.sh) flags the configuration as insecure.

### Why does testssl.sh skip revocation checks by default?

By default, [`testssl.sh`](https://github.com/drwetter/testssl.sh/blob/main/testssl.sh) avoids external network calls to prevent leaking information about scanned certificates to third-party OCSP responders and to ensure the tool works in air-gapped environments. You must explicitly enable external queries with `--phone-out` to contact certificate authorities.

### How do I force OCSP checks when using a proxy?

Set the environment variable **`IGN_OCSP_PROXY=true`** before running the command. By default, the script skips OCSP queries when it detects a proxy configuration at line 2155 of [`testssl.sh`](https://github.com/drwetter/testssl.sh/blob/main/testssl.sh) to prevent certificate information leakage through the proxy tunnel.

### What does a WARN status indicate in OCSP stapling results?

A **WARN** status in the OCSP stapling section indicates that the server provided a stapled response, but the response itself contains an error status or malformed data. According to the error-handling logic at lines 10215-10216, this suggests the server supports stapling but is serving invalid or expired OCSP data.