Certificate revocation is the process of invalidating a certificate before its natural expiry date — necessary when a private key leaks, a certificate was mis-issued, or a domain changes ownership. Two mechanisms exist for browsers to check whether a certificate has been revoked: CRLs and OCSP.
How CRLs work
A Certificate Revocation List is exactly what it sounds like — a CA-published, digitally signed list of every certificate serial number it has revoked, along with when and (optionally) why. Clients download the relevant CRL and check whether the certificate's serial number appears on it. The practical issue: for a large CA, this list can become substantial, and clients would need to download it (or check it via delta updates) regularly to stay current, which doesn't scale gracefully as issuance volume grows industry-wide.
How OCSP works
Online Certificate Status Protocol takes a different approach: instead of downloading an entire list, the client sends a small, specific query — "is this exact certificate revoked?" — to an OCSP responder run by the CA, and gets back a signed, real-time answer: good, revoked, or unknown. This is faster and lighter per check, but introduces a live dependency: the client needs network access to the CA's OCSP responder at connection time, and if that responder is slow or unreachable, browsers have historically had to choose between failing open (allowing the connection, weakening the security guarantee) or failing closed (blocking legitimate traffic if the CA's infrastructure has a bad day).
OCSP Stapling: the practical middle ground
OCSP Stapling addresses OCSP's live-dependency weakness by having the web server itself periodically fetch a signed OCSP response from the CA and "staple" it directly onto the TLS handshake — so the visiting browser gets the revocation status without needing to make its own separate request to the CA at all. This removes the per-visitor latency and privacy concern (the CA no longer sees every individual visitor's browsing pattern via OCSP queries) while still providing a reasonably current revocation check. Most modern web servers support enabling OCSP stapling with a straightforward configuration change.
Why revocation checking is imperfect in practice
In reality, revocation checking has real gaps: some browsers have soft-failed OCSP checks for years (treating an unreachable OCSP responder as "probably fine" rather than blocking the connection), largely because hard-failing caused too many false-positive outages from OCSP infrastructure issues unrelated to actual certificate validity. This is part of why the industry has moved toward shorter certificate lifespans generally — a certificate that's only valid for 90 days limits the exposure window from a compromise even if revocation checking itself doesn't catch it immediately.
What this means for you practically
As a site owner, enable OCSP stapling on your server if it's supported — it's a low-effort, real improvement to how quickly revocation status propagates to visitors without adding per-visitor latency. If you ever suspect your private key has been compromised, revoke the certificate with your CA immediately and reissue with a new key pair — don't rely on revocation checking alone to have contained the exposure by the time you act.
Why revocation exists as a separate mechanism from expiry at all
It's fair to ask why revocation is needed when certificates already expire naturally — the answer is timing. Expiry is fixed at issuance and can be up to 398 days away; revocation exists specifically to handle situations that can't wait that long, most commonly a private key compromise discovered well before the certificate would have expired on its own. Without revocation, a stolen key would remain usable to impersonate a domain for however much of the certificate's lifespan remained, regardless of how quickly the compromise was discovered and reported.
CRL Distribution Points: how a client finds the right list
A certificate that supports CRL-based revocation checking includes a CRL Distribution Point extension — a URL pointing to exactly where the relevant CRL can be downloaded from. This means a client doesn't need to already know where a given CA publishes its revocation list; the certificate itself carries that information, the same way the Authority Information Access extension carries the URL for OCSP checks. Both extensions exist for the same underlying reason: the certificate is meant to be a fully self-describing document, carrying everything a client needs to validate it, rather than requiring separate out-of-band configuration.
Short-lived certificates as a revocation alternative
Because revocation checking has real practical gaps — soft-fail behavior, occasional OCSP responder downtime, and CRLs that aren't always checked promptly by every client — the industry trend has increasingly favored simply shortening certificate lifespans instead of relying more heavily on revocation infrastructure. A certificate valid for only 90 days (Let's Encrypt's approach) or even shorter caps the maximum exposure window from a compromised key at that duration by default, regardless of whether revocation checking catches the problem in between. This is part of a broader, ongoing industry discussion about pushing maximum certificate lifespans even shorter across the board, precisely because a short expiry is a more reliable backstop than revocation checking that depends on every client actually performing the check correctly.
Why revocation checking has real, practical gaps beyond what's already covered
In practice, revocation checking isn't as reliable as it might sound — some browsers historically soft-fail an OCSP check that times out or fails, treating it as "probably fine" rather than blocking the connection, largely because hard-failing caused too many false-positive outages unrelated to actual certificate validity. This is part of why the industry has also leaned on shorter certificate lifespans as a complementary backstop, rather than relying on revocation checking alone.
What OCSP stapling changes about this picture
OCSP stapling has your server periodically fetch a signed revocation status from the CA and include it directly in the handshake, so visiting browsers don't need to make their own separate request to the CA at all — faster for the visitor, and better for privacy, since the CA no longer sees a record of every individual visitor's browsing pattern through repeated OCSP queries.
CRLs revisited: the scaling problem in more detail
A Certificate Revocation List is exactly what it sounds like — a CA-published, signed list of every revoked serial number. The practical issue is that for a large CA, this list can grow substantial, and clients need to download and check it regularly to stay current, which doesn't scale as gracefully as issuance volume grows industry-wide.
Why short certificate lifespans are increasingly treated as the real backstop
Given revocation checking's practical gaps, the industry has increasingly leaned on shortening certificate lifespans generally rather than relying more heavily on revocation infrastructure — a certificate valid for only 90 days caps the maximum exposure window from a compromise at that duration by default, regardless of whether revocation checking catches the problem in between.
Neither OCSP nor CRLs are perfect on their own, which is exactly why the industry has layered stapling and shorter certificate lifespans on top rather than relying on either mechanism in isolation.
A quick closing checklist for a well-configured revocation setup
Confirm OCSP stapling is enabled and actually returning a response, check that your server doesn't rely solely on client-side revocation checking, and keep certificate validity periods short as a complementary backstop — three practices covering current best practice.