---
title: "ocsp.apple.com: what it is and what breaks if you block it · Kilobat"
url: "https://kilobat.app/hosts/ocsp-apple-com"
description: "ocsp.apple.com and ocsp2.apple.com answer certificate revocation checks for Apple's certificates. Why the Mac connects to them, and what breaks if you block them."
---

Security and accounts

# ocsp.apple.com

`ocsp.apple.com` and `ocsp2.apple.com` answer Online Certificate Status Protocol (OCSP) requests for Apple's certificates. The Mac asks them whether a certificate is still valid.

Run by Apple · Ports: 80 TCP (ocsp), 443 TCP (ocsp2) · Checked: 1 November 2026

## Short answer

Apple's certificate status (OCSP) servers. The Mac asks them whether an Apple-issued certificate has been revoked.

Don’t block

Don't block it. The Mac can't check whether Apple-issued certificates were revoked, and Apple services can fail.

Matches

`ocsp.apple.com` `ocsp2.apple.com`

A name with `*.` covers every name under it: `*.push.apple.com` matches `1-courier.push.apple.com`.

## What it serves

Apple's enterprise host list names both in its Certificate validation section. Apple says that devices must reach these hosts to validate the certificates of the services in the list.

`ocsp.apple.com` is on port 80 and `ocsp2.apple.com` on port 443.

On a Mac, [`trustd`](https://kilobat.app/processes/trustd) evaluates certificates. The `ocspd` man page says that OCSP answers are fetched for Security.framework and cached on the Mac.

## Processes that use it

- [trustd](https://kilobat.app/processes/trustd): Part of macOS. It checks certificates for every app, and asks certificate authorities whether a certificate was revoked. Its connections are small.

## What breaks if you block it

Don’t block

Don't block it. The Mac can't check whether Apple-issued certificates were revoked, and Apple services can fail.

What breaks if you block it

- Certificate checks for Apple's services may fail, so those services can stop connecting.
- Revoked Apple-issued certificates may not be detected.

With Kilobat Pro and the network filter, you can block a host for every app or for one app: in Connections, select a connection and choose Block. Apple’s own services are never blocked by Kilobat’s [Protection](https://kilobat.app/docs/blocking#protection) lists.

## Notes

OCSP answers are signed by the certificate authority, so plain HTTP on port 80 doesn't let anyone change them.

The `ocspd` man page says that answers are cached, so most checks don't go to the network again.

## Apple’s rules for its hosts

Apple’s list, [Use Apple products on enterprise networks](https://support.apple.com/en-us/101555), says that devices open these connections, not Apple’s servers. Apple services fail any connection that uses HTTPS interception, so a proxy that inspects TLS should leave Apple’s hosts alone.

If a firewall allows hosts by name, allowing `*.apple.com` covers most Apple services, Apple says. A firewall that works only with addresses can allow `17.0.0.0/8` for IPv4, and `2403:300::/32`, `2620:149::/32` and `2a01:b740::/32` for IPv6.

To see which app on your Mac opened a connection to this host, use Kilobat’s Connections tab, or the [agent network log](https://kilobat.app/docs/agents#agent-network-log) for AI agents.

## Sources

- [Apple Support: Use Apple products on enterprise networks](https://support.apple.com/en-us/101555)
- trustd(8) and ocspd(1), man pages installed with macOS 27.2

Checked on 1 November 2026.

## Related

- [valid.apple.com](https://kilobat.app/hosts/valid-apple-com): An Apple certificate validation host. Apple lists it for every platform, on port 443, with proxy support.
- [crl.apple.com](https://kilobat.app/hosts/crl-apple-com): Apple's hosts for certificate revocation lists and certificates, used to validate the certificates of Apple's services.
- [ocsp.digicert.com](https://kilobat.app/hosts/digicert-ocsp): DigiCert's certificate status and revocation list hosts. Apple lists them because some of its services use DigiCert certificates.
- [“This Connection Is Not Private” and certificate warnings on a Mac](https://kilobat.app/guides/connection-not-private-mac)