Identifying and Managing Apple OCSP – Addigy

Apple's OCSP service checks whether the developer certificate that signed an application has been revoked before macOS allows that application to launch. Understanding how this check behaves on your network helps you explain sudden application slowdowns and decide whether any firewall or hosts file changes on your fleet are still appropriate.

Overview

OCSP (Online Certificate Status Protocol) is an internet standard for checking the revocation status of a certificate. Apple runs an OCSP service that macOS uses to validate application signing certificates.

What it does: Before launching an application, macOS checks with the Apple OCSP service to confirm the developer certificate that signed the application has not been revoked.
Who it's for: Administrators troubleshooting slow or failed application launches on managed Macs, and anyone reviewing firewall or hosts file rules that affect Apple services.
Why it matters: This check is a core part of the security macOS provides. It prevents applications signed with a revoked certificate from running, so leaving it in place protects your fleet.

You can read more about the protocol itself on the Online Certificate Status Protocol reference page.

How macOS Handles Communication to OCSP

This communication happens over port 80 to http://ocsp.apple.com.

The behavior a user sees depends on whether the service is reachable:

Service unreachable: macOS skips the check and launches the application without validation.
Service reachable but degraded or slow: Third-party applications open very slowly or not at all. The device never skips the check in this case, because the service is still reachable.

The results of the OCSP call are cached on the Mac for up to half a day. If a user opens an application multiple times while the OCSP cache is current for that application, the OCSP call is not made.

Note: Because results are cached, a device that is already slow to launch an application may not reproduce the behavior on the next launch. Test with an application the user has not opened recently.

Can I Disable Apple OCSP?

There is no method of disabling this connection natively in macOS. You can block the connection to the service, but Addigy strongly discourages doing so, as this service is a major part of the overall security macOS devices provide.

Background: the Big Sur release

Following the release of macOS 11 Big Sur, the Apple OCSP service became degraded and impacted large numbers of devices across entire fleets. Many administrators immediately implemented a block to ocsp.apple.com to mitigate the problem.

While blocking was understandable during the outage, Addigy strongly recommends removing that block now.

How to Remove a Hosts File Entry Blocking OCSP

Use this workflow if a device has ocsp.apple.com redirected in its /etc/hosts file and you want to restore normal certificate validation. The script below removes the entry, backs up the original hosts file, and resets DNS. If the entry does not exist, the script reports that in its output and makes no changes.

Note: This script only addresses a block created through the hosts file. If OCSP was blocked by another method, such as a firewall or DNS filtering rule, you will need to remove that rule separately.

#!/bin/sh
# Check if there is a line in /etc/hosts containing ocsp block
# if ocsp was blocked another method, this would not account for that method.

if grep -q "ocsp.apple.com" /etc/hosts; then
    echo "Redirect exists for ocsp.apple.com for hosts file , replacing with new..."
    # Remove line
    /usr/bin/sed -i_bak -e '/ocsp.apple.com/d' /etc/hosts
    # Reset DNS
    /usr/bin/killall -HUP mDNSResponder
else
    echo "ocsp.apple.com was not found in your hosts file"
fi

After running the script, review the output. You'll see either Redirect exists for ocsp.apple.com for hosts file , replacing with new... or ocsp.apple.com was not found in your hosts file.

Frequently Asked Questions

Which port and hostname does OCSP use?

Port 80 to http://ocsp.apple.com.

How long are OCSP results cached?

Up to half a day per application. While the cache is current, repeat launches of that application do not trigger a new OCSP call.

Where can I find Apple's documentation on this?

See https://support.apple.com/en-us/HT202491.

Complete Port Usage for Addigy