ERR_SSL_OCSP_INVALID_RESPONSE
ERR_SSL_OCSP_INVALID_RESPONSE — Chrome received an OCSP response but it is corrupted, expired (> 7 days), or signed by the wrong responder cert. Fix: disable ssl_stapling_verify (if the responder is problematic) or refresh OCSP cache. CA outage — wait it out.
Below: causes, fixes, FAQ.
Common Causes
- OCSP response expired — nextUpdate passed
- CA OCSP responder returns stale data
- Cache invalidation delay on CDN
- Wrong OCSP signer cert
- Clock skew on server (> 1 hour)
Step-by-Step Fix
- Check system clock:
timedatectl status - Force OCSP refresh: reload nginx, wait 5 min
- Temporarily disable verify:
ssl_stapling_verify off; - Update chain:
ssl_trusted_certificatewith fresh CA chain - CA outage — valid within an hour
Related SSL Errors
Why teams trust us
How it works
Enter domain
TLS chain verified
Expiry date & vulnerabilities
What Does the SSL Check Cover?
SSL/TLS is the encryption protocol that protects data between the browser and server. Our tool analyzes the certificate, chain of trust, TLS version, and knownvulnerabilities.
Certificate Details
Issuer, validity period, signature algorithm, covered domains (SAN), and validation type (DV/OV/EV).
Chain of Trust
Full chain verification: from leaf certificate through intermediates to root CA.
TLS Analysis
Protocol version (TLS 1.2/1.3), cipher suites, Perfect Forward Secrecy (PFS) support.
Expiry Alerts
Set up a monitor — get Telegram and email alerts 30/14/7 days before expiration.
DV vs OV vs EV Certificates
- Confirms domain ownership only
- Issued in minutes automatically
- Free via Let's Encrypt
- Suitable for most websites
- Most common certificate type
- Organization (OV) or Extended Validation (EV)
- Issued in 1-5 business days
- Costs $50 to $500/year
- For finance, e-commerce, government sites
- Increases user trust
Who uses this
DevOps
SSL certificate monitoring
Security
TLS config audit
SEO
HTTPS as ranking factor
E-commerce
customer trust
Common Mistakes
www and subdomains.Best Practices
Strict-Transport-Security header forces browsers to always use HTTPS.Get more with a free account
SSL certificate monitoring, check history and alerts 30 days before expiry.
Sign up freeLearn more
Frequently Asked Questions
OCSP vs CRL?
OCSP — real-time status check, CRL — list of revoked. OCSP faster (one cert), CRL — all revoked at once. Modern — OCSP stapling.
Short-lived certs killing OCSP?
Let's Encrypt 90d, then 6d (2026+). Cert shorter than CRL refresh — OCSP not needed. Industry trend.
Does Chrome disable OCSP?
By default yes, since 2012 (too slow, privacy). Stapling works, raw OCSP calls do not.
Why this error now?
Usually a single-client issue: stale local cache. Clear Chrome SSL state: chrome://net-internals/#hsts → Delete domain.