> ## Documentation Index
> Fetch the complete documentation index at: https://cockroachlabs.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Using Online Certificate Status Protocol (OCSP) with CockroachDB

export const InternalLink = ({version, path = "", children, ...props}) => {
  let detectedVersion = version || "stable";
  if (typeof window !== 'undefined' && !version) {
    const match = window.location.pathname.match(/\/docs\/([^/]+)/);
    if (match) {
      detectedVersion = match[1];
    }
  }
  const normalizedPath = path.startsWith("/") ? path.slice(1) : path;
  return <a href={`/docs/${detectedVersion}/${normalizedPath}`} {...props}>
      {children}
    </a>;
};

CockroachDB self-hosted supports [Online Certificate Status Protocol (OCSP)](https://wikipedia.org/wiki/Online_Certificate_Status_Protocol) for certificate revocation.

Read more about <InternalLink path="security-reference/transport-layer-security">Public Key Infrastructure (PKI) and Transport Layer Security (TLS) in CockroachDB</InternalLink>.

To enable certificate revocation using your OCSP service:

1. Ensure that your Certificate Authority sets the OCSP server address in the `authorityInfoAccess` field in the certificate.
2. <InternalLink path="set-cluster-setting">Set the cluster setting</InternalLink> `security.ocsp.mode` to `lax` (by default, the cluster setting is set to `off`).

   ```sql theme={"theme":{"light":"catppuccin-mocha","dark":"catppuccin-mocha"}}
     > SHOW CLUSTER SETTING security.ocsp.mode;
   ```

   ```text theme={"theme":{"light":"catppuccin-mocha","dark":"catppuccin-mocha"}}
     security.ocsp.mode
     ----------------------
     off
     (1 row)

     Server Execution Time: 56µs
     Network Latency: 181µs
   ```

   ```sql theme={"theme":{"light":"catppuccin-mocha","dark":"catppuccin-mocha"}}
     > SET CLUSTER SETTING security.ocsp.mode = lax;
   ```

   For production clusters, we recommend that you set `security.ocsp.mode` to `strict`, but only after verifying the configuration with it set to `lax`.

<Note>
  In the `strict` mode, all certificates are presumed to be invalid if the OCSP server is not reachable. Setting the cluster setting `security.ocsp.mode` to `strict` will lock you out of your CockroachDB database if your OCSP server is unavailable.
</Note>