Expired is not deleted
Windows normally retains an OCSP response beyond the time when it can satisfy a revocation check. The difference creates a useful—but conditional—forensic window.
A normal entry becomes eligible for deletion after the later of its response expiry and last synchronization time, plus a flush exemption that defaults to 28 days. A later Cryptnet service scan performs the deletion.
Explore retention scenarios
Day 0 is the initial cache retrieval. Choose a representative case or adjust the values to model an observed entry.
NotAfter caps OCSP validity.
A 30-day-old entry can remain
The response is no longer usable, but it has not reached normal deletion eligibility.
- Valid until
- day 7
- Eligible from
- day 35
- Evidence age
- day 30
Interpret presence cautiously
At day 30, an entry with a seven-day response interval is expected to remain under the ordinary time calculation. It does not identify the process or prove a connection to a candidate hostname.
Eligibility is not deletion. Manual clearing, profile cleanup, no-cache flags, or collection from the wrong identity can shorten or eliminate the observable window.
Examples from this computer
A read-only scan on 2026-11-05 found 60 OCSP-bearing entries in the current user's cache. The times below are UTC. Certificate serials are intentionally omitted.
| Responder and branch | Observed times | Forensic reading |
|---|---|---|
oneocsp.microsoft.comNormal flush; prefetch error 50 |
LastSync: 2026-10-06 10:20:37 Expire: 2026-10-12 20:20:20 Eligible: 2026-11-09 20:20:20 |
The files were still present at about 30 days old because the 28-day post-expiry exemption had not elapsed. |
ocsp.digicert.comNormal flush; prefetch error 50 |
LastSync: 2026-11-04 23:56:35 Expire: 2026-11-11 20:21:00 Eligible: 2026-12-09 20:21:00 |
ExpireTime exactly matched the response's nextUpdate; the default exemption then added 28 days. |
ocsps.ssl.comActive-prefetch candidate; error 0 |
LastSync: 2026-11-05 00:13:27 Expire: 2027-06-07 17:45:56 Normal formula: 2027-07-05 17:45:56 |
The response had a long validity interval and met the active-prefetch conditions. The displayed normal date is not an upper bound while prefetch remains active. |
The scan used cryptnet-dump.exe --ocsp-only --json without --resolve. Retention fields were read directly from the metadata; no serials or URLs were sent to an external service.
The calculation
For the normal service branch, the later of expiry and last synchronization becomes the base for the exemption:
valid_until = min(nextUpdate, certificate.NotAfter)
or min(thisUpdate + 12h, certificate.NotAfter)
flush_base = max(ExpireTime, LastSyncTime)
eligible_at = flush_base + exemption # normally 28 daysActive prefetch can refresh an entry and move LastSyncTime without the original process running. An exemption of 0xFFFFFFFF disables automatic time-based flushing.