[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-12。"],[[["\u003cp\u003eThis document outlines how to implement a delegated Online Certificate Status Protocol (OCSP) responder for checking the revocation status of certificates issued by Certificate Authority Service.\u003c/p\u003e\n"],["\u003cp\u003eOCSP is a protocol used to obtain the revocation status of X.509 certificates, offering benefits such as quicker response times and reduced network bandwidth compared to Certificate Revocation Lists (CRLs).\u003c/p\u003e\n"],["\u003cp\u003eThe OCSP responder pre-generates responses for each certificate issued by a CA, saving them as files in a Cloud Storage bucket.\u003c/p\u003e\n"],["\u003cp\u003eA Cloud Run service acts as the frontend for the OCSP server, with the ability to regenerate these files on demand or on a schedule.\u003c/p\u003e\n"],["\u003cp\u003eCloud CDN can be used to forward requests to Cloud Run and cache OCSP responses, enhancing the efficiency of the system.\u003c/p\u003e\n"]]],[],null,["# Implement a delegated OCSP responder\n====================================\n\n| This page contains a sample provided for demonstration purposes. Google does not officially support this sample. We recommend that you carefully evaluate any solution before deploying it in your production environment.\n\nThis document provides information about the Online Certificate Status Protocol (OCSP)\nresponder that you can use to check the revocation status of certificates\nissued using Certificate Authority Service. For more information about the tool, see [OCSP responder for\nCA Service](https://github.com/googlecloudplatform/gcp-ca-service-ocsp).\n\nWhat is Online Certificate Status Protocol (OCSP)?\n--------------------------------------------------\n\n[OCSP](https://wikipedia.org/wiki/Online_Certificate_Status_Protocol) is a protocol for obtaining the revocation status for\nan X.509 certificate. When a user requests information about the validity of a\ncertificate, a request is sent to an OCSP responder. The OCSP responder checks\nthe status of the certificate with a trusted certificate authority (CA) and\nsends back an OCSP response.\n\nWhy use a delegated OCSP responder?\n-----------------------------------\n\nTracking certificate revocation status using OCSP can have many benefits.\nThese include quicker response time and smaller requirement for network\nbandwidth, as compared to Certificate Revocation Lists (CRLs), which can get\nquite large.\n\nHow does the OCSP responder work?\n---------------------------------\n\nThe OCSP responder pre-generates an OCSP response\nfor each certificate that a particular CA issues. The pre-generated\nresponses are saved as individual files in a Cloud Storage bucket.\n\nYou can deploy a Cloud Run service that regenerates these files\non-demand or on a schedule. The Cloud Run service is essentially the\n*frontend* for the OCSP server.\n\nYou can use [Cloud CDN](/cdn/docs/overview) to forward requests to Cloud Run and cache\nOCSP responses. For more information, see [Setting up Cloud CDN with Cloud Run](/cdn/docs/setting-up-cdn-with-serverless).\n\nFor instructions about configuring an OCSP responder with CA Service,\nsee the [README: OCSP responder for\nCA Service](https://github.com/GoogleCloudPlatform/gcp-ca-service-ocsp/blob/master/README.md)."]]
