Revocation Reason Decoder

Check CRL distribution points and OCSP responder URLs

About Certificate Revocation

Certificate revocation is the process of invalidating a TLS certificate before its expiration date. Revocation can occur for several reasons including key compromise, CA compromise, or cessation of operation. Certificate Authorities publish revocation information through CRL (Certificate Revocation List) distribution points and OCSP (Online Certificate Status Protocol) responders. Our Revocation Reason Decoder extracts these details from any TLS certificate, helping you understand how revocation is handled.

How to Use

Enter the domain name of the server hosting the certificate.
Specify the port number if needed (default is 443).
Click Check to fetch the certificate and decode its revocation information.
Review the CRL distribution points, OCSP responder URLs, and any revocation reason codes.

Use Cases

Revocation Infrastructure Verification: Ensure certificates include valid CRL and OCSP endpoints for revocation checking.
Incident Investigation: Determine why a certificate was revoked by decoding the revocation reason.
CA Evaluation: Compare how different CAs handle revocation and what information they provide in their certificates.
Compliance Auditing: Verify that certificates meet organizational requirements for revocation reporting.

Frequently Asked Questions

A CRL Distribution Point (CRL DP) is a URL in a certificate that points to the location where the Certificate Revocation List is published. Clients use this URL to download the CRL and check if a certificate has been revoked.

Common revocation reasons include: key compromise (the private key was exposed), CA compromise (the CA's private key was compromised), affiliation changed (the subject left the organization), superseded (a new certificate was issued), and cessation of operation (the service was discontinued).

You can check revocation status by querying the CRL Distribution Point or OCSP responder URL found in the certificate. Use our CRL Checker or OCSP Checker tools for real-time revocation status verification.

Tips & Best Practices

•Key compromise (reason 1) requires immediate certificate replacement
•CA compromise (reason 5) requires replacing all certificates from that CA
•Affiliation changed (reason 3) typically means domain ownership changed
•Superseded (reason 0) is normal for certificate renewal or replacement

Technical Details

Standards: RFC 5280 certificate revocation reason codes
Codes: 0-10 defined reasons with plain-language explanations
OCSP: How revocation reasons are communicated via OCSP/CRL
Impact: Trust implications and recommended actions for each reason