ocspresponder

What it is and what it does

ocspresponder is a framework for building RFC 6960 compliant OCSP (Online Certificate Status Protocol) responders in Python. It provides a simple HTTP server that answers certificate status queries, allowing clients to check whether SSL/TLS certificates are valid, revoked, or unknown without downloading full certificate revocation lists.

The framework requires you to implement two custom functions: one that determines a certificate's status (good, revoked, or unknown) given its serial number, and another that retrieves the certificate itself. You supply the issuer's certificate and a dedicated OCSP responder keypair, then instantiate the OCSPResponder and call serve() to launch an HTTP server. The package currently supports the Nonce extension but does not yet handle multiple certificates per request.

Use it for:

• Building a certificate status service for a private PKI or internal CA infrastructure.
• Implementing OCSP responder functionality for testing SSL/TLS certificate validation workflows.
• Serving certificate revocation status to clients that require real-time validation instead of CRL downloads.
• Integrating certificate status checking into a custom certificate management system.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Implements an RFC 6960 compliant OCSP Responder framework for validating certificate status over HTTP, using custom Python functions to determine certificate revocation state and retrieve certificates.

No. The package is abandoned (no releases since 2016, marked as Alpha status) and explicitly states 'Don't use for production yet.' While install friction is low and the license is permissive, the lack of maintenance, undeclared dependencies, and unresolved production-readiness issues make it unsuitable for any deployment. Use only for learning or historical reference.

Install

ocspresponder on PyPI

pip install ocspresponder

uv add ocspresponder

poetry add ocspresponder

Installing ocspresponder

Before you install

Low install friction with no runtime dependencies. However, the package is marked as abandoned with no releases since 2016 and no recent maintenance activity, making it unsuitable for production use.

License in practice

Licensed under Apache License 2.0 (permissive), allowing commercial and private use with minimal restrictions, though the abandoned status raises questions about long-term support.

Quickstart

from ocspresponder import OCSPResponder, CertificateStatus

app = OCSPResponder(
    issuer_cert_path,
    ocsp_cert_path,
    ocsp_key_path,
    validate_func=validate,
    cert_retrieve_func=get_cert,
)
app.serve(port=8080, debug=True)

Requires Python 3.5+ and depends on ocspbuilder, asn1crypto, and Bottle libraries (not listed as explicit runtime deps in this package).

Verify before relying

• Whether ocspbuilder, asn1crypto, and Bottle are correctly declared as runtime dependencies in the package metadata.
• Current compatibility with modern Python versions beyond 3.5.
• Whether the Nonce extension implementation (RFC 6960 Section 4.4.1) is complete and correct.
• Security implications of using an unmaintained OCSP responder in production environments.

Package facts

Evidence: ocspresponder-0.5.0-py3-none-any.whl

Keywords: ocsp, responder, server, ssl, tls, pki

Tags

More Python Modules packages