---
title: "ocsp.digicert.com: what it is, why Macs connect, and what breaks if you block it · Kilobat"
url: "https://kilobat.app/hosts/digicert-ocsp"
description: "ocsp.digicert.com, crl3.digicert.com and crl4.digicert.com are DigiCert's certificate status hosts that Apple lists for macOS. What breaks if you block them."
---

Security and accounts

# ocsp.digicert.com

`ocsp.digicert.com`, `crl3.digicert.com` and `crl4.digicert.com` belong to DigiCert, a certificate authority. Apple lists them, and `ocsp.digicert.cn` for China, for certificate validation.

Run by DigiCert · Ports: 80 TCP · Checked: 1 November 2026

## Short answer

DigiCert's certificate status and revocation list hosts. Apple lists them because some of its services use DigiCert certificates.

Don’t block

Don't block them. Apple lists them for certificate validation, and websites with DigiCert certificates need them too.

Matches

`ocsp.digicert.com` `crl3.digicert.com` `crl4.digicert.com` `ocsp.digicert.cn`

A name with `*.` covers every name under it: `*.push.apple.com` matches `1-courier.push.apple.com`.

## What it serves

Apple's enterprise host list names these four DigiCert hosts in its Certificate validation section, on port 80. Apple says that devices must reach them to validate the certificates of the services in the list.

`ocsp.digicert.cn` is listed for “Certificate validation in China”.

Many websites use DigiCert certificates too, so [`trustd`](https://kilobat.app/processes/trustd) can contact these hosts for sites that aren't Apple's.

## Processes that use it

- [trustd](https://kilobat.app/processes/trustd): Part of macOS. It checks certificates for every app, and asks certificate authorities whether a certificate was revoked. Its connections are small.

## What breaks if you block it

Don’t block

Don't block them. Apple lists them for certificate validation, and websites with DigiCert certificates need them too.

What breaks if you block it

- Certificate checks for Apple services that use DigiCert certificates may fail.
- Revocation checks for websites with DigiCert certificates may fail.

With Kilobat Pro and the network filter, you can block a host for every app or for one app: in Connections, select a connection and choose Block. Apple’s own services are never blocked by Kilobat’s [Protection](https://kilobat.app/docs/blocking#protection) lists.

## Notes

OCSP answers and CRLs are signed by DigiCert, so plain HTTP doesn't let anyone change them.

## Sources

- [Apple Support: Use Apple products on enterprise networks](https://support.apple.com/en-us/101555)
- trustd(8) and ocspd(1), man pages installed with macOS 27.2

Checked on 1 November 2026.

## Related

- [ocsp.apple.com](https://kilobat.app/hosts/ocsp-apple-com): Apple's certificate status (OCSP) servers. The Mac asks them whether an Apple-issued certificate has been revoked.
- [crl.apple.com](https://kilobat.app/hosts/crl-apple-com): Apple's hosts for certificate revocation lists and certificates, used to validate the certificates of Apple's services.
- [Corporate proxy certificates break Terminal tools on a Mac](https://kilobat.app/guides/corporate-proxy-certificates)