Revocation Monitor

Monitor certificate revocation status via CRL/OCSP

Domain

Port

Results

About

The Certificate Revocation Monitor continuously tracks the revocation status of your SSL certificates through both Certificate Revocation Lists (CRL) and the Online Certificate Status Protocol (OCSP). It detects when certificates are revoked by their issuing CA, alerts you to status changes, and helps you understand the revocation reason — whether due to key compromise, CA compromise, affiliation change, superseded, or cessation of operation.

Certificate revocation is a critical security mechanism that allows CAs to invalidate certificates before their expiry date when they are compromised or no longer needed. Without monitoring, you may unknowingly serve a revoked certificate, exposing your users to man-in-the-middle attacks and causing trust warnings in browsers. This tool provides the visibility needed to maintain certificate trust.

How to Use

1Enter the domain name of the certificate you want to monitor
2Click "Check Revocation Status" to query OCSP responder and CRL distribution points
3Review the current status (Good, Revoked, or Unknown) and the revocation reason if applicable
4Set up ongoing monitoring to receive alerts if the status changes

Use Cases

•Security Incident Response: Immediately check if certificates are revoked following a key compromise or security breach event
•Compliance Monitoring: Maintain continuous verification that certificates in production are not revoked, meeting PCI DSS and SOC 2 requirements
•OCSP Stapling Validation: Verify that OCSP stapling is returning the correct revocation status to clients
•CA Distrust Tracking: Monitor certificate status when CAs are distrusted or their intermediate certificates are revoked
•Incident Investigation: Determine when and why a certificate was revoked during security incident forensics

How Status Is Determined

An earlier version of this page opened a connection and reported not revoked and no stapling response as constants — so it could only ever produce a clean answer. It now asks the authority.

1Query the responder named in the certificate, which is where the authoritative answer lives. The AIA extension supplies both the responder URL and the issuer certificate needed to verify the response.
2Report whether the status is actually known. A certificate with no responder, or a responder that could not be reached, reports status unknown rather than clean — because claiming a clean verdict nobody established is the exact failure this replaces.
3Keep a short history of results so a change is visible. The value of monitoring is in the sequence: a certificate that was clean and then is not has just told you something important.

A clean status means nobody has reported this certificate, not that it is safe. Most compromised certificates are never revoked at all, since the attacker has no reason to trigger the process.

Tips & Best Practices

•Enable OCSP stapling on your server to improve privacy and reduce connection latency
•Monitor certificates daily — revocation can happen at any time without advance notice
•Check both CRL and OCSP for comprehensive revocation status, as some CAs only publish to one method
•When a certificate is revoked, renew it immediately with a new key pair

Technical Details

●OCSP Protocol: Queries the CA's OCSP responder for real-time certificate status (Good, Revoked, Unknown)

●CRL Checking: Downloads and parses Certificate Revocation Lists from CRL Distribution Points

●Revocation Reasons: Reports the RFC 5280 revocation reason code (keyCompromise, CACompromise, affiliationChanged, superseded, cessationOfOperation)

●Response Validation: Verifies OCSP responses are signed by the correct CA and are within their validity window

Frequently Asked Questions

OCSP (Online Certificate Status Protocol) provides real-time revocation status by querying the CA's responder directly. CRL (Certificate Revocation List) is a periodically published list of all revoked certificates. OCSP is faster and more current, but CRL provides a complete historical record. Both methods should be checked for comprehensive coverage.

Common reasons include: private key compromise (most serious), CA compromise affecting the intermediate certificate, certificate was issued in error, domain ownership changed, certificate was superseded by a new one, or the certificate holder ceased operations. Each reason has different security implications.

We recommend daily checks for production certificates, and immediate checks after any security incident or CA distrust event. The monitor can be configured to check at regular intervals and alert you immediately if status changes from Good to Revoked.

Either the certificate publishes no OCSP responder, or the responder could not be reached. Both are reported as unknown rather than as clean, and the difference is the whole point of the rewrite. The previous version returned not revoked as a constant regardless of what the authority said, so a revoked certificate would have been reported as fine forever.

Revoked means the authority has said this certificate should no longer be trusted — an authoritative negative that warrants action. Unknown means no answer was obtained, which is an absence of information rather than a clean result. Treating the second as the first produces false alarms; treating the first as the second is how a revoked certificate keeps being served.

Rarely. Unlike expiry, revocation status does not change on a schedule and does not need watching to catch a predictable event. It is worth querying when a certificate is issued, after a key compromise anywhere in your estate, and periodically as a sanity check. Continuous monitoring of revocation is close to unheard of because there is almost nothing to act on.

Because revocation only covers certificates someone has reported. The overwhelming majority of compromised certificates are never revoked at all — the attacker holds a valid certificate and gains nothing by reporting it. A clean status is evidence nobody has reported this certificate, which says something about reputation and nothing about whether it is genuinely yours.

Replace it immediately and find out why. If the reason is key compromise, treat every certificate sharing that key as compromised — which is why the reason matters more than the verdict. A cessation-of-operation revocation is usually routine, but check whether the key was shared with other hosts, because that determines whether the scope is one certificate or several.