> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cockroachlabs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Using Online Certificate Status Protocol (OCSP) with CockroachDB

CockroachDB supports [Online Certificate Status Protocol (OCSP)](https://wikipedia.org/wiki/Online_Certificate_Status_Protocol) for certificate revocation.

Read more about [Public Key Infrastructure (PKI) and Transport Layer Security (TLS) in CockroachDB](https://docs.cockroachlabs.com/docs/stable/security-reference/transport-layer-security.md).

To enable certificate revocation using your OCSP service:

1. Ensure that your Certificate Authority sets the OCSP server address in the `authorityInfoAccess` field in the certificate.
2. [Set the cluster setting](https://docs.cockroachlabs.com/docs/stable/set-cluster-setting.md) `security.ocsp.mode` to `lax` (by default, the cluster setting is set to `off`).

   ```sql theme={"theme":{"light":"catppuccin-mocha","dark":"catppuccin-mocha"}}
   > SHOW CLUSTER SETTING security.ocsp.mode;
   ```

   ```
   security.ocsp.mode
   ----------------------
   off
   (1 row)

   Server Execution Time: 56µs
   Network Latency: 181µs
   ```

   ```sql theme={"theme":{"light":"catppuccin-mocha","dark":"catppuccin-mocha"}}
   > SET CLUSTER SETTING security.ocsp.mode = lax;
   ```

   For production clusters, we recommend that you set `security.ocsp.mode` to `strict`, but only after verifying the configuration with it set to `lax`.

> [!NOTE]
>
> In the `strict` mode, all certificates are presumed to be invalid if the OCSP server is not reachable. Setting the cluster setting `security.ocsp.mode` to `strict` will lock you out of your CockroachDB database if your OCSP server is unavailable.