Security and accounts

ocsp.apple.com

ocsp.apple.com and ocsp2.apple.com answer Online Certificate Status Protocol (OCSP) requests for Apple's certificates. The Mac asks them whether a certificate is still valid.

Run by ApplePorts: 80 TCP (ocsp), 443 TCP (ocsp2)Checked: 1 November 2026

Short answer

Apple's certificate status (OCSP) servers. The Mac asks them whether an Apple-issued certificate has been revoked.

Don’t block

Don't block it. The Mac can't check whether Apple-issued certificates were revoked, and Apple services can fail.

Matches
ocsp.apple.com ocsp2.apple.com

A name with *. covers every name under it: *.push.apple.com matches 1-courier.push.apple.com.

What it serves

Apple's enterprise host list names both in its Certificate validation section. Apple says that devices must reach these hosts to validate the certificates of the services in the list.

ocsp.apple.com is on port 80 and ocsp2.apple.com on port 443.

On a Mac, trustd evaluates certificates. The ocspd man page says that OCSP answers are fetched for Security.framework and cached on the Mac.

Processes that use it

trustdPart of macOS. It checks certificates for every app, and asks certificate authorities whether a certificate was revoked. Its connections are small.Process →

What breaks if you block it

Don’t block

Don't block it. The Mac can't check whether Apple-issued certificates were revoked, and Apple services can fail.

What breaks if you block it

  • Certificate checks for Apple's services may fail, so those services can stop connecting.
  • Revoked Apple-issued certificates may not be detected.

With Kilobat Pro and the network filter, you can block a host for every app or for one app: in Connections, select a connection and choose Block. Apple’s own services are never blocked by Kilobat’s Protection lists.

Notes

OCSP answers are signed by the certificate authority, so plain HTTP on port 80 doesn't let anyone change them.

The ocspd man page says that answers are cached, so most checks don't go to the network again.

Apple’s rules for its hosts

Apple’s list, Use Apple products on enterprise networks, says that devices open these connections, not Apple’s servers. Apple services fail any connection that uses HTTPS interception, so a proxy that inspects TLS should leave Apple’s hosts alone.

If a firewall allows hosts by name, allowing *.apple.com covers most Apple services, Apple says. A firewall that works only with addresses can allow 17.0.0.0/8 for IPv4, and 2403:300::/32, 2620:149::/32 and 2a01:b740::/32 for IPv6.

To see which app on your Mac opened a connection to this host, use Kilobat’s Connections tab, or the agent network log for AI agents.

Sources

Checked on 1 November 2026.