Certificate Revocation Explained (CRL & OCSP)

Reading time: 7 min

What is Certificate Revocation?

An SSL certificate is not always valid until its expiration date.

Sometimes a certificate needs to be cancelled before it expires. This process is called Certificate Revocation.

Once revoked, browsers should no longer trust that certificate, even if it hasn't reached its expiry date.

Certificate revocation helps protect websites and users from compromised or fraudulent certificates.

Why Are SSL Certificates Revoked?

Certificate Authorities (CAs) may revoke certificates for several reasons, including:

The private key has been compromised.
The certificate was issued fraudulently.
The domain ownership changed.
Incorrect information was included in the certificate.
The certificate owner requested revocation.

Revocation immediately removes trust from the certificate.

How Browsers Check Revocation Status

Browsers don't automatically know whether a certificate has been revoked.

Instead, they check the certificate's status using one of two methods:

Certificate Revocation Lists (CRLs)
Online Certificate Status Protocol (OCSP)

Method 1: Certificate Revocation List (CRL)

A Certificate Revocation List (CRL) is exactly what it sounds like.

The Certificate Authority maintains a list containing every certificate that has been revoked.

When a browser checks a certificate, it can download this list and verify whether the certificate appears on it.

Advantages

Simple
Reliable
Supported by all major CAs

Disadvantages

Lists can become very large.
Browsers may need to download an entire list.
Slower than modern alternatives.

Method 2: Online Certificate Status Protocol (OCSP)

OCSP was created to provide a faster method.

Instead of downloading an entire list, the browser asks the Certificate Authority directly:

"Is this certificate still valid?"

The CA immediately replies:

Good
Revoked
Unknown

Because only one certificate is checked, OCSP is much faster than downloading a complete CRL.

OCSP Stapling

Modern web servers often support OCSP Stapling.

Instead of every visitor contacting the Certificate Authority, the web server periodically retrieves the OCSP response and "staples" it to the SSL handshake.

Benefits include:

Faster page loading
Reduced CA traffic
Improved privacy
Better browser performance

Most modern hosting providers recommend enabling OCSP Stapling.

What Happens if a Certificate is Revoked?

If a browser discovers that a certificate has been revoked, users may receive security warnings such as:

NET::ERR_CERT_REVOKED
Certificate has been revoked
Secure connection failed

Most browsers recommend leaving the website immediately.

Why Certificate Revocation Matters

Certificate revocation protects users by preventing compromised certificates from being used to impersonate legitimate websites.

Without revocation, stolen certificates could continue to appear trustworthy until they expired.

Frequently Asked Questions

Does revoking a certificate delete it?

No.

The certificate still exists but is marked as untrusted by the issuing Certificate Authority.

Can a revoked certificate be restored?

No.

A revoked certificate cannot be reactivated.

A new SSL certificate must be issued.

Should websites enable OCSP Stapling?

Yes.

OCSP Stapling improves security, privacy, and website performance while reducing unnecessary requests to Certificate Authorities.