title: Contents of OCSP packets?
body: <p>As far as I know, the web browser use OCSP packets to check if the incoming certificate (from a web server) is still valid or it is revoked. </p>
  
  <p>I have some questions about it:</p>
  
  <p>1- Am I Right about the OCSP?</p>
  
  <p>2- Does the browser send a OCSP request for every incoming cert?</p>
  
  <p>3- Where is the destication of these requests? Root CA?</p>
  
  <p>Well, I monitor the data transmission on my network adapter using Wireshark and I catch the following request :</p>
  
  <p><em>click to enlarge</em></p>
  
  <p><a href="https://i.stack.imgur.com/U5PzL.jpg" rel="nofollow noreferrer">[<img src="https://i.stack.imgur.com/U5PzL.jpg" alt="enter image description here">]<a href="https://i.stack.imgur.com/U5PzL.jpg" rel="nofollow noreferrer">1</a></a></p>
  
  <p>Well, above observation added 3 more question to above questions:</p>
  
  <p>4- I did a whois IP the destination IP and the result shows that it is <a href="http://a23-51-123-27.deploy.static.akamaitechnologies.com" rel="nofollow noreferrer">a23-51-123-27.deploy.static.akamaitechnologies.com</a> . Is it really a Root CA?</p>
  
  <p>5- This request is sent in plain and is not encrypted with SSL protocol! Why? Can't it simply attacked with MITM attacks?</p>
  
  <p>6- This packet contains <em>issuerNameHash</em>, <em>issuerKeyHash</em> and <em>serialNumber</em> only! Are they enough really?! Why hashed values sent?</p>