What Happens When an SSL Certificate is Revoked? | Pingzo

What Happens When an SSL Certificate is Revoked?

An SSL/TLS certificate is the bedrock of trust for modern websites, establishing secure HTTPS connections and encrypting data between browsers and servers. While most administrators focus on certificate expiration dates, a more sudden and disruptive event can occur: SSL Certificate Revocation.

Unlike a natural expiration, revocation is an active invalidation of a certificate before its scheduled expiry date. When a Certificate Authority (CA) revokes a certificate, your website immediately loses its secure status, triggering severe browser warnings that block traffic.

In this guide, we explore why certificates are revoked, how browsers check for revocation using CRL and OCSP protocols, and how to monitor your certificates to prevent unexpected security shutdowns.

Why are SSL Certificates Revoked?

A Certificate Authority will invalidate an SSL certificate early if its integrity is compromised or the ownership context changes. The most common reasons include:

1. Private Key Compromise: If the server private key is leaked, stolen, or exposed in a public repository, the certificate is no longer secure and must be revoked immediately.
2. Incorrect Issuance: If the CA discovers the certificate was issued based on flawed domain validation records or faulty validation processes, it is invalidated.
3. Domain Ownership Changes: If the domain is sold, transferred, or no longer under the control of the original certificate holder, the certificate is revoked.
4. CA Certificate Compromise: In rare cases, if the intermediate or root certificate of the CA itself is compromised, all leaf certificates signed under that chain must be revoked.

How Browsers Verify Revocation Status

When a user visits an HTTPS website, the browser does not just check the certificate dates and domain names. It must also verify that the certificate has not been revoked. This check is performed using two primary protocols:

1. Certificate Revocation Lists (CRL)

A CRL is a blacklist file maintained and regularly updated by the Certificate Authority containing the serial numbers of all revoked certificates.

• The Process: The browser downloads the CRL file from the CA and searches for your certificate's serial number.
• The Downside: CRL files can grow extremely large (sometimes megabytes in size), slowing down page load times. They can also become outdated between browser downloads.

2. Online Certificate Status Protocol (OCSP)

OCSP is a more modern, real-time alternative to CRL.

• The Process: The browser sends a lightweight query containing the certificate's serial number to the CA's OCSP responder. The responder returns a signed response of "Good", "Revoked", or "Unknown".
• The Downside: OCSP requests add network latency to the initial connection handshake. If the CA's OCSP responder experiences downtime, the browser must either fail-closed (block the user) or fail-open (risk allowing a compromised certificate).

3. OCSP Stapling (The Modern Standard)

To solve the latency and privacy issues of standard OCSP, many web servers use OCSP Stapling. The web server regularly queries the CA's OCSP responder itself, obtains a timestamped, cryptographically signed status proof, and "staples" this proof to the TLS handshake when serving users. This allows browsers to verify revocation status instantly without querying the CA.

The Impact of Revocation on Visitors

When a browser detects that a certificate has been revoked, it blocks access to the page and displays a prominent warning.

• Chrome: Displays NET::ERR_CERT_REVOKED or a "Your connection is not private" warning.
• Firefox: Displays SEC_ERROR_REVOKED_CERTIFICATE and completely blocks users from bypassing the warning.
• Safari: Shows a "This website's certificate has been revoked" block screen.

Unlike expired certificates, which some users bypass, modern browsers treat revoked certificates with extreme caution, as they strongly indicate active key compromise or malicious impersonation. This can instantly cut off your users and damage brand reputation.

How to Prevent Revocation Outages

Revocations can happen without the web server administrator's immediate knowledge, especially if triggered by automated CA policies or security alerts.

To prevent sudden security outages, implement these best practices:

• Use OCSP Stapling: Configure your web server (NGINX, Apache, or IIS) to enable OCSP stapling to ensure reliable status delivery.
• Automate Renewals: Use automated ACME clients (like Let's Encrypt Certbot) that can quickly fetch and install a new certificate if the current one is revoked.
• Continuous SSL Monitoring: Monitor your endpoints constantly. Pingzo's uptime engine tracks certificate chains, signature algorithms, and revocation status, sending you instant WhatsApp alerts if your certificate validation breaks.

Test your current SSL configuration using our free SSL Inspector Tool.