Knowledge Base

OCSP and CRL access information

Updated on July 13, 2026

Overview

When a device validates a Sectigo-issued digital certificate, it checks whether that certificate has been revoked using two mechanisms: the Online Certificate Status Protocol (OCSP) and Certificate Revocation Lists (CRL). Both retrieve their data over HTTP from Sectigo servers identified by a Domain Name System (DNS) hostname. This article gives the OCSP server addresses and CRL server addresses your network must reach, and explains why you should allow access by hostname rather than by IP address. By the end, network administrators will know exactly which hostnames and port to permit so certificate validation succeeds for every device on their network.

What are OCSP and CRL?

The Online Certificate Status Protocol (OCSP) lets a device ask the certificate authority, in real time, whether a single certificate is still valid or has been revoked. A Certificate Revocation List (CRL) is a published file listing the certificates that a certificate authority has revoked. Devices query these services automatically during certificate validation, so the servers that host them must be reachable from your network.

OCSP server addresses

Devices reach the Online Certificate Status Protocol (OCSP) responders over HTTP on Transmission Control Protocol (TCP) port 80. Allow outbound access to the following Domain Name System (DNS) hostnames:

Service	DNS hostname	Port
OCSP	ocsp.sectigo.com	TCP/80
OCSP	ocsp.usertrust.com	TCP/80
OCSP	ocsp.comodoca.com	TCP/80

CRL server addresses

Devices download Certificate Revocation Lists (CRL) over HTTP on Transmission Control Protocol (TCP) port 80. Allow outbound access to the following Domain Name System (DNS) hostnames:

Service	DNS hostname	Port
CRL	crl.sectigo.com	TCP/80
CRL	crl.usertrust.com	TCP/80
CRL	crl.comodoca.com	TCP/80

Allow access by hostname, not IP address

Allow these services by their DNS hostname rather than by destination IP address. The IP addresses behind these hostnames change as Sectigo expands its services, so a firewall rule pinned to specific IP addresses can break certificate validation without warning. Permitting the hostnames keeps access working through those changes.

Important note

The list of hostnames above may change over time as Sectigo expands its services. Review it periodically if you maintain static firewall rules.

If you are a network administrator, make sure every computer that might encounter a Sectigo-issued certificate can reach the OCSP and CRL services listed above.