{"id":858,"date":"2014-09-22T19:00:00","date_gmt":"2014-09-22T19:00:00","guid":{"rendered":"https:\/\/fir3netwp.gmsrrpobkbd.com\/2014\/09\/22\/certificate-revocation\/"},"modified":"2021-08-01T00:30:54","modified_gmt":"2021-08-01T00:30:54","slug":"certificate-revocation","status":"publish","type":"post","link":"https:\/\/www.fir3net.com\/Security\/Concepts-and-Terminology\/certificate-revocation.html","title":{"rendered":"Certificate Revocation (CRL vs OCSP)"},"content":{"rendered":"<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_65 counter-hierarchy ez-toc-counter ez-toc-grey ez-toc-container-direction\">\n<p class=\"ez-toc-title\">Table of Contents<\/p>\n<label for=\"ez-toc-cssicon-toggle-item-662034805da70\" class=\"ez-toc-cssicon-toggle-label\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #999;color:#999\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #999;color:#999\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/label><input type=\"checkbox\"  id=\"ez-toc-cssicon-toggle-item-662034805da70\"  aria-label=\"Toggle\" \/><nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/www.fir3net.com\/Security\/Concepts-and-Terminology\/certificate-revocation.html\/#Introduction\" title=\"Introduction\">Introduction<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/www.fir3net.com\/Security\/Concepts-and-Terminology\/certificate-revocation.html\/#Certificate_Types\" title=\"Certificate Types\">Certificate Types<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/www.fir3net.com\/Security\/Concepts-and-Terminology\/certificate-revocation.html\/#Revocation_Methods\" title=\"Revocation Methods\">Revocation Methods<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/www.fir3net.com\/Security\/Concepts-and-Terminology\/certificate-revocation.html\/#CRL\" title=\"CRL\">CRL<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/www.fir3net.com\/Security\/Concepts-and-Terminology\/certificate-revocation.html\/#OCSP\" title=\"OCSP\">OCSP<\/a><ul class='ez-toc-list-level-4' ><li class='ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/www.fir3net.com\/Security\/Concepts-and-Terminology\/certificate-revocation.html\/#OCSP_Stapling\" title=\"OCSP Stapling\">OCSP Stapling<\/a><\/li><\/ul><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/www.fir3net.com\/Security\/Concepts-and-Terminology\/certificate-revocation.html\/#Reference\" title=\"Reference\">Reference<\/a><\/li><\/ul><\/nav><\/div>\n<h2><span class=\"ez-toc-section\" id=\"Introduction\"><\/span>Introduction<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Certificate Revocation is used within PKI (Public Key Infrastructure) to instruct the client that the certificate can no longer be trusted. This is required in scenarios where the private key has been compromised.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Certificate_Types\"><\/span>Certificate Types<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Prior to a CA issuing a certificate to a company the CA performs a level of validation on the authenticity that the company are who they say they are. There are 3 levels of validation ranging from DV (lowest) level all the way up to EV (highest).<\/p>\n<p><strong>Domain Validation (DV)<\/strong> &#8211; This type of certificate is the least expensive of the 3. It requires a basic form of domain validation to be performed. Validation is performed by email.<br \/>\n<strong>Organization Validation (OV)<\/strong> &#8211; When obtaining an OV certificate the company name is checked against a company register, i.e Chamber of Commerce.<br \/>\n<strong>Extended Validation (EV)<\/strong> &#8211; Like OV a company search is performed, however the physical location is also checked and the contact who requested the certificate is also validated.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Revocation_Methods\"><\/span>Revocation Methods<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>CRL (Certificate Revocation) was first released to provide the CA with the ability to revoke certificates., however due to limitations with this method it was superseded by OCSP.<\/p>\n<p>Below details each of these methods along with their main advantages and disadvantages.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"CRL\"><\/span>CRL<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>CRL (Certificate Revocation Lists) contains a list of certificate serial numbers that have been revoked by the CA. The client then checks the serial number from the certificate against the serial numbers within the list (sample shown below).<\/p>\n<pre class=\"prettyprint\">Revoked Certificates:\r\n\u00a0\u00a0\u00a0 Serial Number: 2572757EAAF2BEC5980067579A0A7705\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Revocation Date: May\u00a0 1 19:56:10 2013 GMT\r\n\u00a0\u00a0\u00a0 Serial Number: 776DDD15D25C713616E7D4A8EACFB4A1\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Revocation Date: May 24 13:03:16 2013 GMT<\/pre>\n<p>To instruct the client on where to find the CRL, a CRL distribution point is embedded within each certificate (shown below),<\/p>\n<pre class=\"prettyprint\">X509v3 extensions:\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 X509v3 Authority Key Identifier:\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 keyid:D1:6D:2E:7C:5C:AD:14:FC:2A:72:92:C2:82:CB:B9:6E:DC:A5:C4:02\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 X509v3 Subject Key Identifier:\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 35:42:17:CF:F0:9A:FF:B7:9F:FC:C5:A4:95:D6:68:4F:97:81:1E:1D\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 X509v3 Key Usage: critical\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Digital Signature, Key Encipherment\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 X509v3 Basic Constraints: critical\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 CA:FALSE\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 X509v3 Extended Key Usage:\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 TLS Web Server Authentication, TLS Web Client Authentication\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 X509v3 Certificate Policies:\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Policy: 1.3.6.1.4.1.6449.1.2.2.43\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 CPS: <a href=\"https:\/\/cps.trust-provider.com\/\">https:\/\/cps.trust-provider.com<\/a>\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Policy: 2.23.140.1.2.2\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \r\n          <strong>  X509v3 CRL Distribution Points:<\/strong>\r\n<strong>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 URI:<a href=\"http:\/\/crl.trust-provider.com\/McAfeeOVSSLCA.crl\" class=\"broken_link\">http:\/\/crl.trust-provider.com\/McAfeeOVSSLCA.crl<\/a><\/strong><\/pre>\n<p>The main <strong>disadvantages<\/strong> to CRL are :<\/p>\n<ul>\n<li>Can create a large amount of overhead, as the client has to search through the revocation list. In some cases this can be 1000&#8217;s of lines long.<\/li>\n<li>CRLs are updated periodically every 5-14 days. Potentially leaving the attack surface open until the next CRL update.<\/li>\n<li>The CRL is not checked for OV or DV based certificates.<\/li>\n<li>If the client is unable to download the CRL then by default the client will trust the certificate.<\/li>\n<\/ul>\n<h3><span class=\"ez-toc-section\" id=\"OCSP\"><\/span>OCSP<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>OCSP (Online Certificate Status Protocol) removes many of the disadvantages of CRL by allowing the client to check the certificate status for a single certificate.<\/p>\n<p>The OCSP process in shown below,<\/p>\n<ol>\n<li>Client receives certificate.<\/li>\n<li>Client sends OCSP Request to a OCSP Responder (over HTTP) with the certificates serial number.<\/li>\n<li>OCSP Responder replies with a certificate status of either Good, Revoked or Unknown (shown below)<\/li>\n<\/ol>\n<pre class=\"prettyprint\"><code><strong>Response verify OK<\/strong>\r\n0x25F5V12D5E6FD0BD4EAF2A2C966F3B4aE: good\r\n        This Update: Jan 19 00:24:56 2011 GMT\r\n        Next Update: Jan 26 00:24:56 2011 GMT<\/code><\/pre>\n<p>The main <strong>advantage<\/strong> to OCSP is that because the client can query the status of a single certificate, rather then having to download and parse an entire list there is much less overhead on the client and network.<\/p>\n<p>However the main <strong>disadvantages<\/strong> to OCSP are,<\/p>\n<ul>\n<li>OCSP Requests are sent for each certificate. Because of this there can be a huge over head on the OCSP Responder (i.e the CA) for high traffic websites.<\/li>\n<li>If the private key was comprised the attacker would need to leverage a MITM attack to intercept and pose as the server. Because most browsers slienty ignore OCSP if the protocol times out OCSP can still not be considered a 100% reliable method for mitigating HTTPS server key comprises.<\/li>\n<li>The OCSP is not enforced for OV or DV based certificates. Checked for EV certificates.<\/li>\n<\/ul>\n<h4><span class=\"ez-toc-section\" id=\"OCSP_Stapling\"><\/span>OCSP Stapling<span class=\"ez-toc-section-end\"><\/span><\/h4>\n<p>OCSP Stapling resolves the overhead issues with OCSP and CRL by having the certificate holder (i.e the server) periodically performing the OCSP Request. The OCSP Response is then sent back to the client (i.e stapled) during the SSL handshake.<\/p>\n<p><span class=\"uk-badge\">NOTE<\/span> The OCSP Response is signed by the CA to ensure that it has not been modified before being sent back to the client.<\/p>\n<p>The main <strong>disadvantages<\/strong> with OCSP Stapling are,<\/p>\n<ul>\n<li>Only supported within TLS 1.2.<\/li>\n<li>It is still not supported by many browsers . This results in either the OCSP validity method not being used or standard OCSP being used instead.<\/li>\n<\/ul>\n<h2><span class=\"ez-toc-section\" id=\"Reference\"><\/span>Reference<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<dl class=\"uk-description-list-horizontal\">\n<dt>OCSP<\/dt>\n<dd><a href=\"https:\/\/www.grc.com\/revocation\/commentary.htm\">https:\/\/www.grc.com\/revocation\/commentary.htm<\/a><\/dd>\n<dt>OCSP Stapling<\/dt>\n<dd><a href=\"http:\/\/en.wikipedia.org\/wiki\/OCSP_stapling\">http:\/\/en.wikipedia.org\/wiki\/OCSP_stapling<\/a><\/dd>\n<\/dl>\n","protected":false},"excerpt":{"rendered":"<p>Introduction Certificate Revocation is used within PKI (Public Key Infrastructure) to instruct the client that the certificate can no longer be trusted. This is required in scenarios where the private key has been compromised. Certificate Types Prior to a CA issuing a certificate to a company the CA performs a level of validation on the &#8230; <a title=\"Certificate Revocation (CRL vs OCSP)\" class=\"read-more\" href=\"https:\/\/www.fir3net.com\/Security\/Concepts-and-Terminology\/certificate-revocation.html\" aria-label=\"Read more about Certificate Revocation (CRL vs OCSP)\">Read more<\/a><\/p>\n","protected":false},"author":2,"featured_media":857,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[25],"tags":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v22.5 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Certificate Revocation (CRL vs OCSP) - Fir3net<\/title>\n<meta name=\"description\" content=\"Introduction Certificate Revocation is used within PKI (Public Key Infrastructure) to instruct the client that the certificate can no longer be trusted.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.fir3net.com\/Security\/Concepts-and-Terminology\/certificate-revocation.html\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Certificate Revocation (CRL vs OCSP) - Fir3net\" \/>\n<meta property=\"og:description\" content=\"Introduction Certificate Revocation is used within PKI (Public Key Infrastructure) to instruct the client that the certificate can no longer be trusted.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.fir3net.com\/Security\/Concepts-and-Terminology\/certificate-revocation.html\" \/>\n<meta property=\"og:site_name\" content=\"Fir3net\" \/>\n<meta property=\"article:published_time\" content=\"2014-09-22T19:00:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2021-08-01T00:30:54+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.fir3net.com\/wp-content\/uploads\/2014\/09\/images_articles_certificate.png\" \/>\n\t<meta property=\"og:image:width\" content=\"266\" \/>\n\t<meta property=\"og:image:height\" content=\"297\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Rick Donato\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Rick Donato\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.fir3net.com\/Security\/Concepts-and-Terminology\/certificate-revocation.html#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.fir3net.com\/Security\/Concepts-and-Terminology\/certificate-revocation.html\"},\"author\":{\"name\":\"Rick Donato\",\"@id\":\"https:\/\/www.fir3net.com\/#\/schema\/person\/ab35009601b7687ee1c5310be6038037\"},\"headline\":\"Certificate Revocation (CRL vs OCSP)\",\"datePublished\":\"2014-09-22T19:00:00+00:00\",\"dateModified\":\"2021-08-01T00:30:54+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.fir3net.com\/Security\/Concepts-and-Terminology\/certificate-revocation.html\"},\"wordCount\":674,\"publisher\":{\"@id\":\"https:\/\/www.fir3net.com\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.fir3net.com\/Security\/Concepts-and-Terminology\/certificate-revocation.html#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.fir3net.com\/wp-content\/uploads\/2014\/09\/images_articles_certificate.png\",\"articleSection\":[\"Security Concepts\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.fir3net.com\/Security\/Concepts-and-Terminology\/certificate-revocation.html\",\"url\":\"https:\/\/www.fir3net.com\/Security\/Concepts-and-Terminology\/certificate-revocation.html\",\"name\":\"Certificate Revocation (CRL vs OCSP) - Fir3net\",\"isPartOf\":{\"@id\":\"https:\/\/www.fir3net.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.fir3net.com\/Security\/Concepts-and-Terminology\/certificate-revocation.html#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.fir3net.com\/Security\/Concepts-and-Terminology\/certificate-revocation.html#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.fir3net.com\/wp-content\/uploads\/2014\/09\/images_articles_certificate.png\",\"datePublished\":\"2014-09-22T19:00:00+00:00\",\"dateModified\":\"2021-08-01T00:30:54+00:00\",\"description\":\"Introduction Certificate Revocation is used within PKI (Public Key Infrastructure) to instruct the client that the certificate can no longer be trusted.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.fir3net.com\/Security\/Concepts-and-Terminology\/certificate-revocation.html#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.fir3net.com\/Security\/Concepts-and-Terminology\/certificate-revocation.html\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.fir3net.com\/Security\/Concepts-and-Terminology\/certificate-revocation.html#primaryimage\",\"url\":\"https:\/\/www.fir3net.com\/wp-content\/uploads\/2014\/09\/images_articles_certificate.png\",\"contentUrl\":\"https:\/\/www.fir3net.com\/wp-content\/uploads\/2014\/09\/images_articles_certificate.png\",\"width\":266,\"height\":297},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.fir3net.com\/Security\/Concepts-and-Terminology\/certificate-revocation.html#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.fir3net.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Security\",\"item\":\"https:\/\/www.fir3net.com\/security\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Security Concepts\",\"item\":\"https:\/\/www.fir3net.com\/security\/concepts-security\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"Certificate Revocation (CRL vs OCSP)\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.fir3net.com\/#website\",\"url\":\"https:\/\/www.fir3net.com\/\",\"name\":\"Fir3net\",\"description\":\"Keeping you in the know\",\"publisher\":{\"@id\":\"https:\/\/www.fir3net.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.fir3net.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.fir3net.com\/#organization\",\"name\":\"Fir3net\",\"url\":\"https:\/\/www.fir3net.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.fir3net.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.fir3net.com\/wp-content\/uploads\/Fir3net-Background-Logo-compressed.png\",\"contentUrl\":\"https:\/\/www.fir3net.com\/wp-content\/uploads\/Fir3net-Background-Logo-compressed.png\",\"width\":390,\"height\":88,\"caption\":\"Fir3net\"},\"image\":{\"@id\":\"https:\/\/www.fir3net.com\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.fir3net.com\/#\/schema\/person\/ab35009601b7687ee1c5310be6038037\",\"name\":\"Rick Donato\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.fir3net.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/d75d69a54c0ca3b32c24c3a9703b623c?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/d75d69a54c0ca3b32c24c3a9703b623c?s=96&d=mm&r=g\",\"caption\":\"Rick Donato\"},\"description\":\"Rick Donato is a Network Automation Architect\/Evangelist and the founder of Packet Coders.\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Certificate Revocation (CRL vs OCSP) - Fir3net","description":"Introduction Certificate Revocation is used within PKI (Public Key Infrastructure) to instruct the client that the certificate can no longer be trusted.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.fir3net.com\/Security\/Concepts-and-Terminology\/certificate-revocation.html","og_locale":"en_US","og_type":"article","og_title":"Certificate Revocation (CRL vs OCSP) - Fir3net","og_description":"Introduction Certificate Revocation is used within PKI (Public Key Infrastructure) to instruct the client that the certificate can no longer be trusted.","og_url":"https:\/\/www.fir3net.com\/Security\/Concepts-and-Terminology\/certificate-revocation.html","og_site_name":"Fir3net","article_published_time":"2014-09-22T19:00:00+00:00","article_modified_time":"2021-08-01T00:30:54+00:00","og_image":[{"width":266,"height":297,"url":"https:\/\/www.fir3net.com\/wp-content\/uploads\/2014\/09\/images_articles_certificate.png","type":"image\/jpeg"}],"author":"Rick Donato","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Rick Donato","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.fir3net.com\/Security\/Concepts-and-Terminology\/certificate-revocation.html#article","isPartOf":{"@id":"https:\/\/www.fir3net.com\/Security\/Concepts-and-Terminology\/certificate-revocation.html"},"author":{"name":"Rick Donato","@id":"https:\/\/www.fir3net.com\/#\/schema\/person\/ab35009601b7687ee1c5310be6038037"},"headline":"Certificate Revocation (CRL vs OCSP)","datePublished":"2014-09-22T19:00:00+00:00","dateModified":"2021-08-01T00:30:54+00:00","mainEntityOfPage":{"@id":"https:\/\/www.fir3net.com\/Security\/Concepts-and-Terminology\/certificate-revocation.html"},"wordCount":674,"publisher":{"@id":"https:\/\/www.fir3net.com\/#organization"},"image":{"@id":"https:\/\/www.fir3net.com\/Security\/Concepts-and-Terminology\/certificate-revocation.html#primaryimage"},"thumbnailUrl":"https:\/\/www.fir3net.com\/wp-content\/uploads\/2014\/09\/images_articles_certificate.png","articleSection":["Security Concepts"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.fir3net.com\/Security\/Concepts-and-Terminology\/certificate-revocation.html","url":"https:\/\/www.fir3net.com\/Security\/Concepts-and-Terminology\/certificate-revocation.html","name":"Certificate Revocation (CRL vs OCSP) - Fir3net","isPartOf":{"@id":"https:\/\/www.fir3net.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.fir3net.com\/Security\/Concepts-and-Terminology\/certificate-revocation.html#primaryimage"},"image":{"@id":"https:\/\/www.fir3net.com\/Security\/Concepts-and-Terminology\/certificate-revocation.html#primaryimage"},"thumbnailUrl":"https:\/\/www.fir3net.com\/wp-content\/uploads\/2014\/09\/images_articles_certificate.png","datePublished":"2014-09-22T19:00:00+00:00","dateModified":"2021-08-01T00:30:54+00:00","description":"Introduction Certificate Revocation is used within PKI (Public Key Infrastructure) to instruct the client that the certificate can no longer be trusted.","breadcrumb":{"@id":"https:\/\/www.fir3net.com\/Security\/Concepts-and-Terminology\/certificate-revocation.html#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.fir3net.com\/Security\/Concepts-and-Terminology\/certificate-revocation.html"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.fir3net.com\/Security\/Concepts-and-Terminology\/certificate-revocation.html#primaryimage","url":"https:\/\/www.fir3net.com\/wp-content\/uploads\/2014\/09\/images_articles_certificate.png","contentUrl":"https:\/\/www.fir3net.com\/wp-content\/uploads\/2014\/09\/images_articles_certificate.png","width":266,"height":297},{"@type":"BreadcrumbList","@id":"https:\/\/www.fir3net.com\/Security\/Concepts-and-Terminology\/certificate-revocation.html#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.fir3net.com\/"},{"@type":"ListItem","position":2,"name":"Security","item":"https:\/\/www.fir3net.com\/security"},{"@type":"ListItem","position":3,"name":"Security Concepts","item":"https:\/\/www.fir3net.com\/security\/concepts-security"},{"@type":"ListItem","position":4,"name":"Certificate Revocation (CRL vs OCSP)"}]},{"@type":"WebSite","@id":"https:\/\/www.fir3net.com\/#website","url":"https:\/\/www.fir3net.com\/","name":"Fir3net","description":"Keeping you in the know","publisher":{"@id":"https:\/\/www.fir3net.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.fir3net.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.fir3net.com\/#organization","name":"Fir3net","url":"https:\/\/www.fir3net.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.fir3net.com\/#\/schema\/logo\/image\/","url":"https:\/\/www.fir3net.com\/wp-content\/uploads\/Fir3net-Background-Logo-compressed.png","contentUrl":"https:\/\/www.fir3net.com\/wp-content\/uploads\/Fir3net-Background-Logo-compressed.png","width":390,"height":88,"caption":"Fir3net"},"image":{"@id":"https:\/\/www.fir3net.com\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.fir3net.com\/#\/schema\/person\/ab35009601b7687ee1c5310be6038037","name":"Rick Donato","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.fir3net.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/d75d69a54c0ca3b32c24c3a9703b623c?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d75d69a54c0ca3b32c24c3a9703b623c?s=96&d=mm&r=g","caption":"Rick Donato"},"description":"Rick Donato is a Network Automation Architect\/Evangelist and the founder of Packet Coders."}]}},"_links":{"self":[{"href":"https:\/\/www.fir3net.com\/wp-json\/wp\/v2\/posts\/858"}],"collection":[{"href":"https:\/\/www.fir3net.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.fir3net.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.fir3net.com\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.fir3net.com\/wp-json\/wp\/v2\/comments?post=858"}],"version-history":[{"count":0,"href":"https:\/\/www.fir3net.com\/wp-json\/wp\/v2\/posts\/858\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.fir3net.com\/wp-json\/wp\/v2\/media\/857"}],"wp:attachment":[{"href":"https:\/\/www.fir3net.com\/wp-json\/wp\/v2\/media?parent=858"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.fir3net.com\/wp-json\/wp\/v2\/categories?post=858"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.fir3net.com\/wp-json\/wp\/v2\/tags?post=858"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}