← Back to glossary

🧯

Certificate Revocation

Encryption

Certificate Authority (CA) Public Key Infrastructure (PKI) OCSP CRL (Certificate Revocation List)

Mechanisms to invalidate certificates before expiry (CRLs/OCSP), with ecosystem reliability considerations.

Definition

Revocation is published via CRLs or queried via OCSP. In practice, short-lived certs and stapling reduce reliance on revocation checks.

In plain English Mechanisms to invalidate certificates before expiry (CRLs/OCSP), with ecosystem reliability considerations.

Why this matters

Why it matters: Compromised certs enable impersonation; revocation and short lifetimes reduce risk.

Example

Example: Revoke on suspected key compromise, rotate keys, and use short-lived certs with automated renewal.