Certificate revocation is the process of invalidating a digital certificate before its scheduled expiration date, making it untrusted by browsers and other clients even though it has not yet expired.
Certificate revocation invalidates a certificate before its natural expiration, typically because its private key was compromised, the holder’s status changed, or the certificate was issued fraudulently. CA/Browser Forum Baseline Requirements mandate revocation within 24 hours of a confirmed key compromise. Clients check revocation status through CRLs or OCSP before trusting a certificate.
Key Takeaways
- Key compromise triggers a 24-hour revocation requirement. CA/Browser Forum Baseline Requirements mandate revocation within 24 hours once a key compromise, mis-issuance, or CA compromise is confirmed.
- Revocation is different from expiration. Expiration happens automatically on a schedule; revocation is a deliberate action taken before that schedule completes, usually for cause.
- Three mechanisms let clients check revocation status. Base CRLs, Delta CRLs, and OCSP each provide a way to confirm whether a certificate is still trusted.
- Revocation checking is not perfectly reliable at internet scale. Some browsers fail open on a timed-out OCSP check, which is part of why the industry is also shortening certificate validity periods.
- A revoked certificate must be replaced, not just removed. Restoring secure communication requires issuing and installing a new, valid certificate, not simply taking the old one offline.
When Is a Certificate Revoked?
Four situations account for most certificate revocations, and only one of them is routine.
- Compromised private key. If a private key falls into unauthorized hands, the CA revokes the certificate to render that key useless for further impersonation.
- Change in the holder’s status. An employee leaving an organization, for example, can make a certificate they had access to no longer trustworthy.
- Detection of fraudulent certificates. CAs actively monitor for suspicious or unauthorized certificates and revoke them on detection.
- Natural expiration. Not revocation in the strict sense, but CRLs and OCSP communicate expired status the same way they communicate revoked status.
How Certificate Revocation Works
Revoking a certificate requires the right administrative permissions and a documented reason code.
A CA Administrator or a delegated certificate manager, granted Issue and Manage Certificates permission, revokes the certificate through the issuing CA’s console. The administrator selects the affected certificate, chooses an appropriate reason code, such as key compromise or cessation of operation, and confirms the revocation. Under CA/Browser Forum Baseline Requirements, a confirmed key compromise must be revoked within 24 hours; issues like expired domain validation carry a 5-day window.
How Clients Identify a Revoked Certificate
Three mechanisms give relying parties a way to check whether a certificate is still trusted.
| Mechanism | How it works | Tradeoff |
|---|---|---|
| Base CRL | Full signed list of all certificates a CA has revoked | Grows large over time; downloaded in full |
| Delta CRL | Lists only certificates revoked since the last base CRL | Smaller, faster updates between base publications |
| OCSP | Real-time responder service queried per certificate | Faster per-check, but some clients fail open on timeout |
How Encryption Consulting Helps
CertSecure Manager gives incident response and PKI teams a single console to revoke and reissue certificates immediately, with full visibility into every certificate in inventory so the 24-hour revocation window is never at risk of being missed. Backed by ISO/IEC 27001:2022 and SOC 2 certified practices.
Frequently Asked Questions
How fast must a compromised certificate be revoked?
CA/Browser Forum Baseline Requirements mandate revocation within 24 hours of a confirmed key compromise, mis-issuance, or CA compromise. Some other issues, such as expired domain validation, carry a longer 5-day window, but a compromised key always falls into the 24-hour category.
What is the difference between a Base CRL and a Delta CRL?
A Base CRL lists every certificate a CA has revoked and is signed as a complete snapshot. A Delta CRL lists only certificates revoked since the last Base CRL was published, allowing faster, smaller updates for clients that already have the base list.
Does OCSP always catch a revoked certificate immediately?
Not always. OCSP queries a responder service in real time, which is faster than downloading a full CRL, but some browsers fail open and continue trusting a certificate if the OCSP check times out. This limitation is part of why the industry is also moving toward shorter certificate validity periods.
Can a revoked certificate be reinstated?
No. Revocation is permanent for that certificate. If the underlying need for the certificate still exists, for example the server still needs to serve HTTPS traffic, the holder must obtain a new certificate with a new key pair rather than attempting to un-revoke the old one.
Revoke and Reissue Without the Delay
See CertSecure Manager in action to revoke and reissue certificates within the 24-hour compliance window, every time.