Why certificate revocation does not work and how short lifetimes fix it
When a private key leaks you revoke the certificate; but does the browser find out? Usually not. Shrinking lifetimes close exactly that gap.
8 September 2026 · 5 min read
Two mechanisms
- CRL (revocation list)
- The authority publishes a list of revoked certificates (RFC 5280). The list grows; if the client does not download it or uses a stale copy, the revocation is invisible.
- OCSP
- The client queries the authority in real time for every certificate (RFC 6960). Privacy (the authority sees which sites you visit), latency and the question of what happens when the authority is unreachable are the problems.
- OCSP stapling
- The server attaches a signed OCSP response obtained from the authority to the TLS handshake; the client does not contact the authority. It needs correct configuration.
What browsers do
- Most browsers do not drop the connection on an OCSP error; if an attacker can block OCSP, the revocation is invisible.
- Chrome ships its own compact revocation lists (CRLSets) with the browser; not every revocation makes it into them.
- Let's Encrypt announced in 2024 that it would end its OCSP service and moved revocation information to CRLs; the CA/Browser Forum rules also make OCSP optional and CRLs mandatory.
Why short lifetimes are the answer
- The certificate becomes invalid by itself after 47 days; the abuse window of a leaked key is at most that long.
- Cases where revocation checks fail (blocked OCSP, stale CRL) lose their importance with short lifetimes.
- Since automatic renewal is mandatory anyway, obtaining a new certificate after a revocation goes through the same pipeline.
- This is one of the core reasons behind ballot SC-081.
What it means for your organisation
- When you must revoke: notify the authority, generate a new key pair, install the new certificate and verify that the target serves the new fingerprint.
- A revocation is not complete until the inventory shows every system the old certificate was installed on.
- Keep OCSP stapling enabled on servers; if your authority has dropped OCSP, move to CRL distribution.
Frequently asked questions
- If OCSP goes away, how is revocation checked?
- Authorities keep publishing CRLs; browsers compile them into aggregated lists. For application clients, CRL download is configured.
- Why does a certificate I revoked still work?
- The client may not check revocation or may use a stale list. The definitive fix is to remove the certificate from the servers and install the new one.
Sources
More articles
Manage your certificates in one place
Inventory, expiry tracking, renewal through ACME and verified installation, on your own infrastructure.