Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Mengimplementasikan penanggap OCSP yang didelegasikan
Dokumen ini memberikan informasi tentang responder Online Certificate Status Protocol (OCSP)
yang dapat Anda gunakan untuk memeriksa status pencabutan sertifikat
yang diterbitkan menggunakan Certificate Authority Service. Untuk mengetahui informasi selengkapnya tentang alat ini, lihat Penjawab OCSP untuk
Layanan CA.
Apa yang dimaksud dengan Online Certificate Status Protocol (OCSP)?
OCSP adalah protokol untuk mendapatkan status pembatalan untuk
sertifikat X.509. Saat pengguna meminta informasi tentang validitas
sertifikat, permintaan akan dikirim ke responden OCSP. Respons OCSP memeriksa
status sertifikat dengan certificate authority (CA) tepercaya dan
mengirimkan kembali respons OCSP.
Mengapa menggunakan responden OCSP yang didelegasikan?
Melacak status pencabutan sertifikat menggunakan OCSP dapat memiliki banyak manfaat.
Hal ini mencakup waktu respons yang lebih cepat dan persyaratan yang lebih kecil untuk lebar jaringan, dibandingkan dengan Daftar Pencabutan Sertifikat (CRL), yang dapat menjadi cukup besar.
Bagaimana cara kerja OCSP responder?
Respons OCSP dibuat sebelumnya oleh responsor OCSP
untuk setiap sertifikat yang diterbitkan oleh CA tertentu. Respons yang dibuat sebelumnya disimpan sebagai file individual di bucket Cloud Storage.
Anda dapat men-deploy layanan Cloud Run yang membuat ulang file ini sesuai permintaan atau sesuai jadwal. Layanan Cloud Run pada dasarnya adalah frontend untuk server OCSP.
Anda dapat menggunakan Cloud CDN untuk meneruskan permintaan ke Cloud Run dan menyimpan respons OCSP dalam cache. Untuk mengetahui informasi selengkapnya, lihat Menyiapkan Cloud CDN dengan Cloud Run.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-12 UTC."],[[["\u003cp\u003eThis document outlines how to implement a delegated Online Certificate Status Protocol (OCSP) responder for checking the revocation status of certificates issued by Certificate Authority Service.\u003c/p\u003e\n"],["\u003cp\u003eOCSP is a protocol used to obtain the revocation status of X.509 certificates, offering benefits such as quicker response times and reduced network bandwidth compared to Certificate Revocation Lists (CRLs).\u003c/p\u003e\n"],["\u003cp\u003eThe OCSP responder pre-generates responses for each certificate issued by a CA, saving them as files in a Cloud Storage bucket.\u003c/p\u003e\n"],["\u003cp\u003eA Cloud Run service acts as the frontend for the OCSP server, with the ability to regenerate these files on demand or on a schedule.\u003c/p\u003e\n"],["\u003cp\u003eCloud CDN can be used to forward requests to Cloud Run and cache OCSP responses, enhancing the efficiency of the system.\u003c/p\u003e\n"]]],[],null,["# Implement a delegated OCSP responder\n====================================\n\n| This page contains a sample provided for demonstration purposes. Google does not officially support this sample. We recommend that you carefully evaluate any solution before deploying it in your production environment.\n\nThis document provides information about the Online Certificate Status Protocol (OCSP)\nresponder that you can use to check the revocation status of certificates\nissued using Certificate Authority Service. For more information about the tool, see [OCSP responder for\nCA Service](https://github.com/googlecloudplatform/gcp-ca-service-ocsp).\n\nWhat is Online Certificate Status Protocol (OCSP)?\n--------------------------------------------------\n\n[OCSP](https://wikipedia.org/wiki/Online_Certificate_Status_Protocol) is a protocol for obtaining the revocation status for\nan X.509 certificate. When a user requests information about the validity of a\ncertificate, a request is sent to an OCSP responder. The OCSP responder checks\nthe status of the certificate with a trusted certificate authority (CA) and\nsends back an OCSP response.\n\nWhy use a delegated OCSP responder?\n-----------------------------------\n\nTracking certificate revocation status using OCSP can have many benefits.\nThese include quicker response time and smaller requirement for network\nbandwidth, as compared to Certificate Revocation Lists (CRLs), which can get\nquite large.\n\nHow does the OCSP responder work?\n---------------------------------\n\nThe OCSP responder pre-generates an OCSP response\nfor each certificate that a particular CA issues. The pre-generated\nresponses are saved as individual files in a Cloud Storage bucket.\n\nYou can deploy a Cloud Run service that regenerates these files\non-demand or on a schedule. The Cloud Run service is essentially the\n*frontend* for the OCSP server.\n\nYou can use [Cloud CDN](/cdn/docs/overview) to forward requests to Cloud Run and cache\nOCSP responses. For more information, see [Setting up Cloud CDN with Cloud Run](/cdn/docs/setting-up-cdn-with-serverless).\n\nFor instructions about configuring an OCSP responder with CA Service,\nsee the [README: OCSP responder for\nCA Service](https://github.com/GoogleCloudPlatform/gcp-ca-service-ocsp/blob/master/README.md)."]]
