Check if a certificate has been revoked via OCSP or CRL
Revocation Status
OCSP Response
Status:
Revocation reason:
CRL Status
Not fetched. A CRL lookup needs the certificate's distribution point and downloads the full list, so it is a separate check — use the CRL Distribution Point Checker for that.
About Certificate Revocation Checker
Checks certificate revocation status using CRL and OCSP protocols. Verifies whether a certificate has been revoked by its issuing Certificate Authority.
How to Use
1Enter domain or paste certificate
2Click Check Revocation
3Review status
Use Cases
•Verify certificate validity
•Incident response
•Compliance checking
Frequently Asked Questions
Certificate revocation is when a Certificate Authority invalidates a certificate before its expiry date, typically due to key compromise, mis-issuance, or changes in the certificate subject.
CRL (Certificate Revocation List) is a list of revoked certificates published by the CA. OCSP (Online Certificate Status Protocol) provides real-time revocation status checks. OCSP is generally faster and more current.
OCSP responses are typically updated within hours of a revocation event. CRLs are published on a schedule set by the CA, usually every 24 hours. Some CAs provide delta CRLs for more frequent updates.
It means the certificate names no OCSP responder, so no one can ask the authority about this certificate over OCSP. This is not a fault in your setup and not a pass: revocation may still be published, as a CRL. Several of the largest public authorities have moved away from OCSP entirely because of the cost of serving it at scale, so an empty result is increasingly ordinary rather than a warning sign. Where the certificate does publish a CRL, the CRL Distribution Point Checker reads that list.
GOOD is the authority confirming the certificate is valid, which is the answer you are looking for. REVOKED means it has been withdrawn, usually for a named reason, and browsers will reject the certificate. UNKNOWN is the important one to recognise: the authority could not confirm either way, which is not the same as good. Treat UNKNOWN as unresolved rather than safe, check the production timestamp, and retry before you conclude anything about the certificate.
The reason codes are defined in RFC 5280 and each points at a different response. keyCompromise means the private key is known to an attacker and needs replacing now. CACompromise means the authority itself was breached, which affects every certificate it issued. superseded means a newer certificate replaced this one. cessationOfOperation is a planned shutdown, and affiliationChanged and privilegeWithdrawn cover a renamed organisation or a role that no longer applies. In every case the remedy is the same: replace the certificate rather than argue with the reason.
Because building a valid request needs the issuer's name and public key, and the tool obtains them from the certificate's own Authority Information Access extension. When that extension names no issuer certificate, or the address is unreachable, there is no way to identify the certificate to the responder without inventing those values. Rather than send a request that would be rejected or, worse, answered ambiguously, the check stops and reports that the status could not be determined. That is a limitation of the lookup path, not evidence about your certificate.
No, this page queries the OCSP responder only. A CRL is a different mechanism: a single published file listing every withdrawn certificate, fetched whole rather than queried per certificate. They can disagree in principle, though a well-run authority keeps them consistent. If your certificate publishes a CRL and no OCSP responder, use the CRL Distribution Point Checker instead — that is the path that will actually tell you something.
How the OCSP Check Works
A verdict here comes from the certificate authority itself, not from an assumption. When the authority cannot answer, the result says so rather than reporting a pass.
1Complete a handshake and read the leaf certificate, with verification switched off so a broken setup is still readable.
2Read the Authority Information Access extension, which supplies both the OCSP responder address and, usually, the address of the issuing certificate. A certificate with no OCSP URL is reported as such: an increasing number of major authorities now publish a CRL only.
3Retrieve the issuer and check it against the certificate. If the issuer published does not match the issuer named in the certificate, the check stops rather than sending a request that cannot be trusted.
4Build a request identifying the certificate by issuer and serial number, and post it to the responder.
5Report what came back: GOOD, REVOKED with a reason, or UNKNOWN — with the response's own production and expiry timestamps so you can judge how current the answer is.
Tips & Best Practices
•Check certificate revocation status before trusting certificates
•Use multiple revocation checking methods for reliability
•Monitor revocation status changes for security awareness
•Understand soft-fail vs hard-fail revocation checking implications
Technical Details
Methods: OCSP and CRL revocation status checking OCSP: Online Certificate Status Protocol real-time check CRL: Certificate Revocation List download and check Output: Revocation status with method and timestamp
