Global Trust Fabric — OCSP responder

What this is

This endpoint answers OCSP requests for issuers that have delegated status signing to the Global Trust Fabric responder. It fails closed: when status data, freshness, clock or signing credentials cannot be confirmed it answers tryLater, never good.

The service is in its pilot phase. The only issuer served today is the GTF Pilot CA, which is not trusted by any browser or operating system and exists for demonstration and integration testing.

Try it

Download the pilot CA and the demonstration certificates from /pilot/, then:

openssl ocsp -issuer ca.pem -cert demo-good.pem -url http://ocsp.csmic.ca/ -CAfile ca.pem -resp_text
openssl ocsp -issuer ca.pem -cert demo-revoked.pem -url http://ocsp.csmic.ca/ -CAfile ca.pem

Protocol profile

POST application/ocsp-request (up to 8 KiB) or GET with the base64 request appended to the URL. One certificate per request. Nonces of 1–128 octets are echoed. Served over plain HTTP by design, because OCSP clients often cannot follow HTTPS redirects; responses are signed.