Is OCSP Request Signing Necessary?

The best I can find is from a draft version 2 of X.509 Internet Public Key Infrastructure Online Certificate Status Protocol - OCSP proposal, which later became RFC 2560. It states that:

The requester signature is used to authenticate the requester to the OCSP Responder. It is used in conjunction with the requester certificate extension defined below.

This document is also the first instance of the signature in the ABNF breakdown of the request. Later versions of the document say even less about the subject.

The signature has to be optional as many (if not most) relying parties will not have a public/private key pair with which to sign the OCSP Request.

In addition to this vagueness, the The Lightweight Online Certificate Status Protocol (OCSP) Profile for High-Volume Environments protocol defined in RFC 5019 says the following about signed requests:

Clients SHOULD NOT send signed OCSPRequests. Responders MAY ignore the signature on OCSPRequests.

In neither documents is there a reason for expecting a client to sign the request.


The connection to the OCSP responder does not need to be protected by HTTPS (it often is HTTP only) and the OCSP responder does not even need to be the authoritive source for the OCSP response, it can just forward responses it got from somewhere else. The signature instead is done by the authoritive source.