What ADSS OCSP Server delivers

ADSS OCSP Server delivers highly available, real-time certificate status validation as a core component of the Ascertia PKI platform. It ensures certificates remain trustworthy throughout their lifecycle — supporting digital trust for enterprise, government, and regulated environments.

ADSS OCSP Server is a high-performance Online Certificate Status Protocol (OCSP) responder delivering real-time certificate revocation validation for enterprise, government, and regulated PKI environments. As a core component of the Ascertia PKI platform, it ensures digital certificates remain trustworthy throughout their lifecycle, enabling secure digital identities, transactions, and legally binding electronic signatures at scale.

Built for scale, resilience, and long-term trust, ADSS OCSP Server supports multi-CA environments and high-volume deployments where availability and compliance are essential.

  • Multi-CA OCSP responder with policy-based control
  • High-availability architectures for enterprise and national-scale PKI
  • Standards-compliant, audit-ready validation services
  • Designed for future-ready and post-quantum PKI environments
ADSS OCSP Server Illustration

Scale, resilience, and performance

ADSS OCSP Server is designed for high-volume certificate validation, with scalable and resilient deployment options to meet demanding PKI requirements.

Optimised response performance

Handles thousands of OCSP queries per second, with performance tuning and advanced CRL processing to optimise performance for different environments.

High availability

Multiple load-balanced servers can work concurrently, with resilient secondary sites available where required to support demanding business continuity needs.

Distributed architecture

Separate back-end servers can process CRLs while front-end servers handle OCSP requests and responses, providing greater flexibility for complex and high-volume deployments.

Public Key Infrastructure does not end at certificate issuance. Real-time validation is essential to maintaining trust across digital identities, transactions, and services.

ADSS OCSP Server acts as the real-time validation engine of the Ascertia PKI platform. It enables relying parties to instantly determine the revocation status of certificates without the latency and operational overhead of CRLs.

By completing the PKI lifecycle, issuance, management, and validation, ADSS OCSP Server ensures certificate trust can be continuously verified at scale.

Digital trust requires more than availability, it requires validation services that are provable, auditable, and sustainable over time.

ADSS OCSP Server is designed for environments where certificate status must be continuously verifiable and defensible. It supports strong cryptographic controls, secure response signing using HSM-protected keys, and detailed audit logging to meet regulatory and governance requirements.

Aligned with Ascertia's future-ready PKI strategy, the platform supports evolving cryptographic standards and post-quantum readiness initiatives, ensuring validation services remain reliable as security frameworks advance.

This makes ADSS OCSP Server suitable for long-term trust use cases such as government services, regulated financial systems, and legally binding digital transactions.

ADSS OCSP Server provides granular control over certificate validation policies across complex, multi-CA environments. It enables organisations to define how certificate status is evaluated and enforced in line with internal governance and regulatory requirements. Key capabilities include:

  • Per-CA and per-certificate validation policies
  • Allowed and denied list
  • Secure OCSP response signing using HSM-protected keys
  • Role-based administrative access

ADSS OCSP Server operates as a core validation component within the Ascertia Digital Trust Platform.

It integrates with:

  • Ascertia PKI for certificate issuance and lifecycle management
  • Digital Signature Services for trusted signing workflows
  • Timestamping Authorities (TSA) for long-term validation
  • Long-Term Validation (LTV) and archival services

This integrated architecture enables organisations to deploy certificate issuance, validation, signing, and preservation services within a unified, standards-based trust framework.

Quantum computing will eventually break the RSA and ECC signatures that every OCSP response relies on today. ADSS OCSP Server lets you plan that migration on your terms. Each CA served by the responder can use its own signing algorithm (RSA, ECDSA or the NIST-standardised post-quantum ML-DSA), so classical and quantum-safe hierarchies run side by side from a single deployment. Responder certificates can be issued and auto-renewed by the built-in CA, which turns an algorithm change into a configuration change rather than a re-architecture. ML-DSA is implemented to FIPS 204, with certificates profiled per RFC 9881, and our published benchmarks give real throughput and response-size figures to plan capacity against.

Monitoring, Audit, and Standards Compliance

ADSS OCSP Server provides the visibility, evidence, and standards alignment required in regulated PKI environments. Capabilities include:

Capabilities

Real-time monitoring of responder health and traffic. Detailed logging of OCSP requests and responses

Built-in OCSP request/response viewer for troubleshooting. Usage and activity reporting for audit, compliance, and billing support

RFC 6960, RFC 5019, and RFC 8954 compliant. PKI-agnostic and interoperable with standards-compliant CAs

ADSS OCSP Server supports Ascertia’s transition to Post-Quantum Cryptography, helping organisations prepare their certificate validation infrastructure for the post-quantum era.

Supports regulatory and audit requirements across industries

Deployment models

Flexible deployment and Architecture ADSS OCSP Server supports on-premise, virtualised, and cloud native environments and integrates with Hardware Security Modules (HSMs), for secure response signing. The platform is compatible with enterprise and national PKI deployments and supports integration into existing CA infrastructures.

High-availability single-site cluster

Active-active multi-site deployment

Segmented architectures with DMZ-based responders

Next steps

Ready to move forward? Explore our reference architectures or speak with a specialist to plan your deployment.

  • Explore reference architectures
  • Speak to a PKI and validation specialist
Request a Demo Contact Us

FAQs

An OCSP request is sent through to the ADSS OCSP Server. The server supports RFC 6960 and RFC 5019 validation services. It provides support for multiple CAs with unique, individual validation policies. The OCSP request checks the specific certificate serial number with a trusted CA. Once checked, an OCSP response is sent back in real time with a response of ‘good’, ‘revoked’ or ‘unknown’. For more information on the ADSS OCSP Server process, please visit our blog

Ascertia’s ADSS OCSP Server meets the following certifications and standards:

Initial product installation and setup is easy using a wizard. Operators are guided on how to configure the database, main operator account, trust models and any Hardware Security Module (HSM) details. It also helps setup CAs, their validation policies, CRL monitoring and event reporting. View our datasheet for more in-depth information on this.

Secure web-based management and advanced management reporting are provided as standard. These features include security configuration options and detailed reporting. Detailed, role-based access controls ensure staff have access to what they need and nothing else. Event and transaction logs are created within the ADSS OCSP Server console. They can be used to create usage reports and identify high demand users, certificates or IP addresses.

Ascertia’s ADSS OCSP Server has been designed to handle high availability and offers significant load capacity.

  • It configured to offer high scalability and availability to meet the most demanding infrastructure needs.
  • Multiple load balanced servers work concurrently with resilient secondary sites available where required.

Thanks to its distributed architecture, core services can be split. This process enables separate back-end servers to process CRLs while front-end servers handle requests and responses. Customers can also use the ADSS OCSP Gateway to protect multi-tier data centres. For more information, visit the ADSS OCSP Server datasheet

ADSS OCSP Server supports a range of operating systems, databases and HSMs. As supported platforms and versions are updated over time, please refer to the latest ADSS Platform Support Report for the current list of tested and supported environments.

Supported Operating Systems:

  • Microsoft Server 2022, 2019 and 2016
  • Linux RedHat, SUSE, CentOS and Ubuntu

Supported Databases:

  • Microsoft SQL Server 2016, 2017 and 2019
  • Oracle 12c, 18c and 19c
  • Azure SQL Database
  • PostgreSQL 10, 11 and 12
  • MySQL 5 and 8
  • Percona-XtraDB-Cluster 5

Supported HSMs:

  • Thales Luna and Protect Server
  • Entrust nShield
  • Ultimaco Security Server
  • Microsoft Azure Key Vault
  • Amazon AWS Cloud HSM (Linux only)

Yes, provided each CA has its own OCSP responder signing key and certificate in the matching algorithm family. The responder identifies the issuing CA from each request and signs the response with that CA’s responder key, so relying parties that only support classical algorithms continue to receive classically signed responses. What you cannot do is sign responses for both CAs with a single responder key: a classical-only relying party cannot verify a PQC-signed response, and vice versa. Note that PQC-signed responses are significantly larger, which may affect OCSP stapling and caching.