Revocation Monitor

Monitor certificate revocation status via CRL/OCSP

Domain

Port

Results

About

The Certificate Revocation Monitor continuously tracks the revocation status of your SSL certificates through both Certificate Revocation Lists (CRL) and the Online Certificate Status Protocol (OCSP). It detects when certificates are revoked by their issuing CA, alerts you to status changes, and helps you understand the revocation reason — whether due to key compromise, CA compromise, affiliation change, superseded, or cessation of operation.

Certificate revocation is a critical security mechanism that allows CAs to invalidate certificates before their expiry date when they are compromised or no longer needed. Without monitoring, you may unknowingly serve a revoked certificate, exposing your users to man-in-the-middle attacks and causing trust warnings in browsers. This tool provides the visibility needed to maintain certificate trust.

How to Use

1Enter the domain name of the certificate you want to monitor
2Click "Check Revocation Status" to query OCSP responder and CRL distribution points
3Review the current status (Good, Revoked, or Unknown) and the revocation reason if applicable
4Set up ongoing monitoring to receive alerts if the status changes

Use Cases

•Security Incident Response: Immediately check if certificates are revoked following a key compromise or security breach event
•Compliance Monitoring: Maintain continuous verification that certificates in production are not revoked, meeting PCI DSS and SOC 2 requirements
•OCSP Stapling Validation: Verify that OCSP stapling is returning the correct revocation status to clients
•CA Distrust Tracking: Monitor certificate status when CAs are distrusted or their intermediate certificates are revoked
•Incident Investigation: Determine when and why a certificate was revoked during security incident forensics

Tips & Best Practices

•Enable OCSP stapling on your server to improve privacy and reduce connection latency
•Monitor certificates daily — revocation can happen at any time without advance notice
•Check both CRL and OCSP for comprehensive revocation status, as some CAs only publish to one method
•When a certificate is revoked, renew it immediately with a new key pair

Technical Details

●OCSP Protocol: Queries the CA's OCSP responder for real-time certificate status (Good, Revoked, Unknown)

●CRL Checking: Downloads and parses Certificate Revocation Lists from CRL Distribution Points

●Revocation Reasons: Reports the RFC 5280 revocation reason code (keyCompromise, CACompromise, affiliationChanged, superseded, cessationOfOperation)

●Response Validation: Verifies OCSP responses are signed by the correct CA and are within their validity window

Frequently Asked Questions

OCSP (Online Certificate Status Protocol) provides real-time revocation status by querying the CA's responder directly. CRL (Certificate Revocation List) is a periodically published list of all revoked certificates. OCSP is faster and more current, but CRL provides a complete historical record. Both methods should be checked for comprehensive coverage.

Common reasons include: private key compromise (most serious), CA compromise affecting the intermediate certificate, certificate was issued in error, domain ownership changed, certificate was superseded by a new one, or the certificate holder ceased operations. Each reason has different security implications.

We recommend daily checks for production certificates, and immediate checks after any security incident or CA distrust event. The monitor can be configured to check at regular intervals and alert you immediately if status changes from Good to Revoked.