Security and accounts

ocsp.digicert.com

ocsp.digicert.com, crl3.digicert.com and crl4.digicert.com belong to DigiCert, a certificate authority. Apple lists them, and ocsp.digicert.cn for China, for certificate validation.

Run by DigiCertPorts: 80 TCPChecked: 1 November 2026

Short answer

DigiCert's certificate status and revocation list hosts. Apple lists them because some of its services use DigiCert certificates.

Don’t block

Don't block them. Apple lists them for certificate validation, and websites with DigiCert certificates need them too.

Matches
ocsp.digicert.com crl3.digicert.com crl4.digicert.com ocsp.digicert.cn

A name with *. covers every name under it: *.push.apple.com matches 1-courier.push.apple.com.

What it serves

Apple's enterprise host list names these four DigiCert hosts in its Certificate validation section, on port 80. Apple says that devices must reach them to validate the certificates of the services in the list.

ocsp.digicert.cn is listed for “Certificate validation in China”.

Many websites use DigiCert certificates too, so trustd can contact these hosts for sites that aren't Apple's.

Processes that use it

trustdPart of macOS. It checks certificates for every app, and asks certificate authorities whether a certificate was revoked. Its connections are small.Process →

What breaks if you block it

Don’t block

Don't block them. Apple lists them for certificate validation, and websites with DigiCert certificates need them too.

What breaks if you block it

  • Certificate checks for Apple services that use DigiCert certificates may fail.
  • Revocation checks for websites with DigiCert certificates may fail.

With Kilobat Pro and the network filter, you can block a host for every app or for one app: in Connections, select a connection and choose Block. Apple’s own services are never blocked by Kilobat’s Protection lists.

Notes

OCSP answers and CRLs are signed by DigiCert, so plain HTTP doesn't let anyone change them.

Sources

Checked on 1 November 2026.