Test certificates for the demo OCSP responder

Upload a test certificate to the demo.sk.ee/aia OCSP responder and choose which status it should return. Works with almost any X.509 certificate – test ID-card, Mobile-ID, Smart-ID or your own.

Status must be Good to create signatures in the demo environment
Expired certificates are always reported as revoked
Any RFC 6960 OCSP client works — more about demo endpoints

Upload certificate Check status

Your certificate

Certificate Choose file… or drop the file here, or paste PEM text below

PEM or binary DER (.cer, .crt, .pem), up to 8 KB. Estonian ID card: save the certificate from the DigiDoc4 application.

Issuer (CA) certificate — optional

Only needed if your certificate has no Authority Key Identifier extension, or the AKI does not contain the SHA-1 hash of the issuer’s public key.

Issuer (CA) certificate Choose file… or drop the file here, or paste PEM text below

Status the responder should return

GoodValid – positive answer to the status request. RevokedRevoked permanently or temporarily (on hold). UnknownThe responder does not know the certificate.

Testing service – upload test certificates only. Uploaded certificates and request details are logged.

Command line

Upload (status 5 = good, 6 = revoked, 1 = unknown):

curl -sS --data-urlencode sert@cert.pem \
     -d status=5 \
     https://demo.sk.ee/upload_cert/

Check the status with OpenSSL:

openssl ocsp -issuer issuer.pem -cert cert.pem \
  -url http://demo.sk.ee/aia -no_nonce -noverify -resp_text