checkId: check.timestamp.ocsp.responder plugin: stellaops.doctor.timestamping severity: warn tags: [timestamping, ocsp, responder, revocation, air-gap]

OCSP Responder Availability

This Stella Ops Doctor check verifies that the OCSP (Online Certificate Status Protocol) responders used to validate timestamping authority (TSA) certificates are reachable. It is most relevant to operators running policy-gated, eIDAS-aware, or air-gapped release pipelines, where live revocation status must be obtainable for evidence to remain verifiable.

What It Checks

Verifies that configured OCSP responders are accessible. The check:

Reads the configured OCSP responders from the registry.
Sends an OPTIONS request to each responder with a 10-second timeout.
Treats 2xx and 405 (Method Not Allowed) responses as healthy.
Fails if all responders are unavailable; warns if some are unavailable.
Reports Degraded if no responders are configured.

Air-Gap Behavior

When the deployment is sealed by AirGap policy, or STELLAOPS_DOCTOR_OFFLINE_PROFILE=true forces Doctor offline mode, Doctor does not contact external OCSP responders. Instead, the check consults the typed offline-kit artefact registry (IAirGapArtefactStore) keyed by SHA-256 of responderUri|nameHashHex|keyHashHex (ocsp/<sha256>.der). For each configured responder, the check synthesises a stable cert-id key from ForCertificateIssuer (matching the offline-kit builder’s convention) and looks up the response. On match the check emits Healthy with the canonical evidence rows airGapSealed=true, source=offline-kit, artefactSha256=…, artefactIssuedAt=…, plus the OCSP producedAt. When no snapshot is shipped for any configured responder, the check fails closed (source=offline-kit-missing).

The OCSP cache TTL is 15 minutes, or shorter when the OCSP response nextUpdate requires it.

Why It Matters

OCSP responders provide real-time certificate revocation status. If OCSP responders are unavailable, the system cannot verify whether TSA certificates have been revoked, potentially accepting timestamps from compromised certificates.

Common Causes

OCSP responder server is down
Network connectivity issues
Firewall blocking HTTP/HTTPS to OCSP URLs
OCSP responder URL changed by the CA

How to Fix

Docker Compose

# Test OCSP responder connectivity
docker exec <platform-container> curl -v http://ocsp.digicert.com

Bare Metal / systemd

# Test OCSP responder
openssl ocsp -issuer /path/to/issuer.pem -cert /path/to/cert.pem \
  -url http://ocsp.digicert.com -resp_text

Kubernetes / Helm

Ensure egress NetworkPolicies allow traffic to OCSP responder URLs.

Verification

stella doctor run --check check.timestamp.ocsp.responder

OCSP Stapling Enabled (check.timestamp.ocsp.stapling) — checks OCSP stapling configuration
Revocation Cache Freshness (check.timestamp.revocation.cache-fresh) — checks revocation cache freshness
CRL Distribution Point Availability (check.timestamp.crl.distribution) — checks CRL distribution point availability