Certificate Revocation List Monitoring And Validation Tool — Complete Documentation & Simulation

Overview & System Context

Certificate Revocation List Monitoring And Validation Tool: Comprehensive Web-Sourced Technical Investigation Exhaustive Research Dossier · Pure Web-Scraped Content: ~9501 Words · Real Software Screenshots: 1 1. Executive Overview & Technical Background In cryptography, a certificate authority or certification authority (CA) is an entity that stores, signs, and issues digital certificates. A digital certificate certifies the ownership of a public key by the named subject of the certificate. This allows others (relying parties) to rely upon signatures or on assertions made about the private key that corresponds to the certified public key. A CA acts as a trusted third party—trusted both by the subject (owner) of the certificate and by the party relying upon the certificate. The format of these certificates is specified by the X.509 or EMV standard.

One particularly common use for certificate authorities is to sign certificates used in HTTPS, the secure browsing protocol for the World Wide Web. Another common use is in issuing identity cards by national governments for use in electronically signing documents. The clients of a CA are server supervisors who call for a certificate that their servers will bestow to users. Commercial CAs charge money to issue certificates, and their customers anticipate the CA's certificate to be contained within the majority of web browsers, so that safe connections to the certified servers work efficiently out-of-the-box. The quantity of web browsers, other devices, and applications which trust a particular certificate authority is referred to as ubiquity. Mozilla, which is a non-profit business, issues several commercial CA certificates with its products. While Mozilla developed their own policy, the CA/Browser Forum developed similar guidelines for CA trust. A single CA certificate may be shared among multiple CAs or their resellers. A root CA certificate may be the base to issue multiple intermediate CA certificates with varying validation requirements.

In addition to commercial CAs, some non-profits issue publicly-trusted digital certificates without charge, for example Let's Encrypt. Some large cloud computing and web hosting companies are also publicly-trusted CAs and issue certificates to services hosted on their infrastructure, for example IBM Cloud, Amazon Web Services, Cloudflare, and Google Cloud Platform.

Figure 1: Figure 1: Verified System Architecture & Pipeline Workflow Large organizations or government bodies may have their own PKIs (public key infrastructure), each containing their own CAs. Any site using self-signed certificates acts as its own CA. Commercial banks that issue EMV payment cards are governed by the EMV Certificate Authority, payment schemes that route payment transactions initiated at Point of Sale Terminals (POS) to a Card Issuing Bank to transfer the funds from the card holder's bank account to the payment recipient's bank account. Each payment card presents along with its card data also the Card Issuer Certificate to the POS. The Issuer Certificate is signed by EMV CA Certificate. The POS retrieves the public key of EMV CA from its storage, validates the Issuer Certificate and authenticity of the payment card before sending the payment request to the payment scheme.

Browsers and other clients of sorts characteristically allow users to add or do away with CA certificates at will. While server certificates regularly last for a relatively short period, CA certificates are further extended, so, for repeatedly visited servers, it is less error-prone importing and trusting the CA issued, rather than confirm a security exemption each time the server's certificate is renewed.

Less often, trustworthy certificates are used for encrypting or signing messages. CAs dispense end-user certificates too, which can be used with S/MIME. However, encryption entails the receiver's public key and, since authors and receivers of encrypted messages, apparently, know one another, the usefulness of a trusted third party remains confined to the signature verification of messages sent to public mailing lists.

However, the market for globally trusted TLS/SSL server certificates is largely held by a small number of multinational companies. This market has significant barriers to entry due to the technical requirements. While not legally required, new providers may choose to undergo annual security audits (such as WebTrust for certificate authorities in North America and ETSI in Europe) to be included as a trusted root by a web browser or operating system.

As of 24 August 2020, 147 root certificates, representing 52 organizations, are trusted in the Mozilla Firefox web browser, 168 root certificates, representing 60 organizations, are trusted by macOS, and 255 root certificates, representing 101 organizations, are trusted by Microsoft Windows. As of Android 4.2 (Jelly Bean), Android currently contains over 100 CAs that are updated with each release.

On November 18, 2014, a group of companies and nonprofit organizations, including the Electronic Frontier Foundation, Mozilla, Cisco, and Akamai, announced Let's Encrypt, a nonprofit certificate authority that provides free domain validated X.509 certificates as well as software to enable installation and maintenance of certificates. Let's Encrypt is operated by the newly formed Internet Security Research Group, a California nonprofit recognized as federally tax-exempt.

According to Netcraft in May 2015, the industry standard for monitoring active TLS certificates, "Although the global [TLS] ecosystem is competitive, it is dominated by a handful of major CAs — three certificate authorities (Symantec, Comodo CA, GoDaddy) account for three-quarters of all issued [TLS] certificates on public-facing web servers. The top spot has been held by Symantec (or VeriSign before it was purchased by Symantec) ever since [our] survey began, with it currently accounting for just under a third of all certificates. To illustrate the effect of differing methodologies, amongst the million busiest sites Symantec issued 44% of the valid, trusted certificates in use — significantly more than its overall market share." As of July 2024 the survey company W3Techs, which collects statistics on certificate authority usage among the Alexa top 10 million and the Tranco top 1 million websites, lists the five largest authorities by absolute usage share as below.

The commercial CAs that issue the bulk of certificates for HTTPS servers typically use a technique called "domain validation" to authenticate the recipient of the certificate. The techniques used for domain validation vary between CAs, but in general domain validation techniques are meant to prove that the certificate applicant controls a given domain name, not any information about the applicant's identity.

Many Certificate Authorities also offer Extended Validation (EV) certificates as a more rigorous alternative to domain validated certificates. Extended validation is intended to verify not only control of a domain name, but additional identity information to be included in the certificate. Some browsers display this additional identity information in a green box in the URL bar. One limitation of EV as a solution to the weaknesses of domain validation is that attackers could still obtain a domain validated certificate for the victim domain, and deploy it during an attack; if that occurred, the difference observable to the victim user would be the absence of a green bar with the company name. There is some question whether users would be likely to recognize this absence as indicative of an attack being in progress: a test using Internet Explorer 7 in 2009 showed that the absence of IE7's EV warnings were not noticed by users, however Microsoft's newer browser, Edge Legacy, shows a significantly greater difference between EV and domain validated certificates, with domain validated certificates having a hollow, gray lock.

Domain validation suffers from certain structural security limitations. In particular, it is always vulnerable to attacks that allow an adversary to observe the domain validation probes that CAs send. These can include attacks against the DNS, TCP, or BGP protocols (which lack the cryptographic protections of TLS/SSL), or the compromise of routers. Such attacks are possible either on the network near a CA, or near the victim domain itself.

One of the most common domain validation techniques involves sending an email containing an authentication token or link to an email address that is likely to be administratively responsible for the domain. This could be the technical contact email address listed in the domain's WHOIS entry, or an administrative email like admin@, administrator@, webmaster@, hostmaster@ or postmaster@ the domain. Some Certificate Authorities may accept confirmation using root@, info@, or support@ in the domain. The theory behind domain validation is that only the legitimate owner of a domain would be able to read emails sent to these administrative addresses.

Domain validation implementations have sometimes been a source of security vulnerabilities. In one instance, security researchers showed that attackers could obtain certificates for webmail sites because a CA was willing to use an email address like ssladmin@domain.com for domain.com, but not all webmail systems had reserved the "ssladmin" username to prevent attackers from registering it.

Prior to 2011, there was no standard list of email addresses that could be used for domain validation, so it was not clear to email administrators which addresses needed to be reserved. The first version of the CA/Browser Forum Baseline Requirements, adopted November 2011, specified a list of such addresses. This allowed mail hosts to reserve those addresses for administrative use, though such precautions are still not universal. In January 2015, a Finnish man registered the username "hostmaster" at the Finnish version of Microsoft Live and was able to obtain a domain-validated certificate for live.fi, despite not being the owner of the domain name.

A CA issues digital certificates that contain a public key and the identity of the owner. The matching private key is not made available publicly, but kept secret by the end user who generated the key pair. The certificate is also a confirmation or validation by the CA that the public key contained in the certificate belongs to the person, organization, server or other entity noted in the certificate. A CA's obligation in such schemes is to verify an applicant's credentials, so that users and relying parties can trust the information in the issued certificate. CAs use a variety of standards and tests to do so. In essence, the certificate authority is responsible for saying "yes, this person is who they say they are, and we, the CA, certify that".

If the user trusts the CA and can verify the CA's signature, then they can also assume that a certain public key does indeed belong to whoever is identified in the certificate. The rest of the communication then proceeds using the new (disposable) symmetric key, so when the user enters some information to the bank's page and submits the page (sends the information back to the bank) then the data the user has entered to the page will be encrypted by their web browser. Therefore, even if someone can access the (encrypted) data that was communicated from the user to www.bank.example, such eavesdropper cannot read or decipher it.

This mechanism is only safe if the user can be sure that it is the bank that they see in their web browser. If the user types in www.bank.example, but their communication is hijacked and a fake website (that pretends to be the bank website) sends the page information back to the user's browser, the fake web-page can send a fake public key to the user (for which the fake site owns a matching private key). The user will fill the form with their personal data and will submit the page. The fake web-page will then get access to the user's data.

This is what the certificate authority mechanism is intended to prevent. A certificate authority (CA) is an organization that stores public keys and their owners, and every party in a communication trusts this organization (and knows its public key). When the user's web browser receives the public key from www.bank.example it also receives a digital signature of the key (with some more information, in a so-called X.509 certificate). The browser already possesses the public key of the CA and consequently can verify the signature, trust the certificate and the public key in it: since www.bank.example uses a public key that the certification authority certifies, a fake www.bank.example can only use the same public key. Since the fake www.bank.example does not know the corresponding private key, it cannot create the signature needed to verify its authenticity.

a signature, contract or other record relating to such transaction may not be denied legal effect, validity, or enforceability solely because it is in electronic form; and a contract relating to such transaction may not be denied legal effect, validity or enforceability solely because an electronic signature or electronic record was used in its formation. Despite the security measures undertaken to correctly verify the identities of people and companies, there is a risk of a single CA issuing a bogus certificate to an imposter. It is also possible to register individuals and companies with the same or very similar names, which may lead to confusion. To minimize this hazard, the certificate transparency initiative proposes auditing all certificates in a public unforgeable log, which could help in the prevention of phishing.

In large-scale deployments, Alice may not be familiar with Bob's certificate authority (perhaps they each have a different CA server), so Bob's certificate may also include his CA's public key signed by a different CA2, which is presumably recognizable by Alice. This process typically leads to a hierarchy or mesh of CAs and CA certificates. A certificate may be revoked before it expires, which signals that it is no longer valid. Without revocation, an attacker would be able to exploit such a compromised or misissued certificate until expiry. Hence, revocation is an important part of a public key infrastructure. Revocation is performed by the issuing CA, which produces a cryptographically authenticated statement of revocation.

For distributing revocation information to clients, timeliness of the discovery of revocation (and hence the window for an attacker to exploit a compromised certificate) trades off against resource usage in querying revocation statuses and privacy concerns. If revocation information is unavailable (either due to accident or an attack), clients must decide whether to fail-hard and treat a certificate as if it is revoked (and so degrade availability) or to fail-soft and treat it as unrevoked (and allow attackers to sidestep revocation).

Due to the cost of revocation checks and the availability impact from potentially-unreliable remote services, Web browsers limit the revocation checks they will perform, and will fail-soft where they do. Certificate revocation lists are too bandwidth-costly for routine use, and the Online Certificate Status Protocol presents connection latency and privacy issues. Other schemes have been proposed but have not yet been successfully deployed to enable fail-hard checking.

The CA/Browser Forum publishes the Baseline Requirements, a list of policies and technical requirements for CAs to follow. These are a requirement for inclusion in the certificate stores of Firefox and Safari. On April 14, 2025, the CA/Browser Forum passed a ballot to reduce SSL/TLS certificates to 47 day maximum term by March 15, 2029.

If the CA can be subverted, then the security of the entire system is lost, potentially subverting all the entities that trust the compromised CA. For example, suppose an attacker, Eve, manages to get a CA to issue to her a certificate that claims to represent Alice. That is, the certificate would publicly state that it represents Alice, and might include other information about Alice. Some of the information about Alice, such as her employer name, might be true, increasing the certificate's credibility. Eve, however, would have the all-important private key associated with the certificate. Eve could then use the certificate to send a digitally signed email to Bob, tricking Bob into believing that the email was from Alice. Bob might even respond with encrypted email, believing that it could only be read by Alice, when Eve is actually able to decrypt it using the private key.

A notable case of CA subversion like this occurred in 2001, when the certificate authority VeriSign issued two certificates to a person claiming to represent Microsoft. The certificates have the name "Microsoft Corporation", so they could be used to spoof someone into believing that updates to Microsoft software came from Microsoft when they actually did not. The fraud was detected in early 2001. Microsoft and VeriSign took steps to limit the impact of the problem.

2. System Architecture & Core Working Principles In 2008, Comodo CA reseller Certstar sold a certificate for mozilla.com to Eddy Nigg, who had no authority to represent Mozilla. In 2011 fraudulent certificates were obtained from Comodo CA and DigiNotar, allegedly by Iranian hackers. There is evidence that the fraudulent DigiNotar certificates were used in a man-in-the-middle attack in Iran.

In 2012, it became known that Trustwave issued a subordinate root certificate that was used for transparent traffic management (man-in-the-middle) which effectively permitted an enterprise to sniff SSL internal network traffic using the subordinate certificate. In 2012, the Flame malware (also known as SkyWiper) contained modules that had an MD5 collision with a valid certificate issued by a Microsoft Terminal Server licensing certificate that used the broken MD5 hash algorithm. The authors thus was able to conduct a collision attack with the hash listed in the certificate.

In 2015, a Chinese certificate authority named MCS Holdings and affiliated with China's central domain registry issued unauthorized certificates for Google domains. Google thus removed both MCS and the root certificate authority from Chrome and have revoked the certificates. CAs sometimes use a key ceremony when generating signing keys, in order to ensure that the keys are not tampered with or copied.

This issue is the driving impetus behind the development of the DNS-based Authentication of Named Entities (DANE) protocol. If adopted in conjunction with Domain Name System Security Extensions (DNSSEC) DANE will greatly reduce if not eliminate the role of trusted third parties in a domain's PKI. Chung, Taejoong; Lok, Jay; Chandrasekaran, Balakrishnan; Choffnes, David; Levin, Dave; Maggs, Bruce M.; Mislove, Alan; Rula, John; Sullivan, Nick; Wilson, Christo (2018). "Is the Web Ready for OCSP Must-Staple?" (PDF). Proceedings of the 53223350. Larisch, James; Choffnes, David; Levin, Dave; Maggs, Bruce M.; Mislove, Alan; Wilson, Christo (2017). "CRLite: A Scalable System for Pushing All TLS Revocations to All Browsers". 2017 IEEE Symposium on Security and Privacy (SP). pp.

Thomas (November 2022). Recommendations for Secure Use of Transport Layer Security (TLS) and Datagram Transport "Let's Revoke: Scalable Global Certificate Revocation". Proceedings 2020 Network and Distributed System Security Let's Encrypt is a non-profit certificate authority run by the Internet Security Research Group (ISRG) that provides X.509 certificates for Transport Layer Security (TLS) encryption without charging fees. It is the world's largest certificate authority, used by more than 700 million websites, with the goal of creating a more secure and privacy-respecting web through the widespread adoption of HTTPS. The Internet Security Research Group, the provider of the service, is a public benefit organization. Major sponsors of the ISRG include the Electronic Frontier Foundation (EFF), the Mozilla Foundation, OVHcloud, Cisco Systems, Facebook, Google Chrome, the Internet Society, AWS, nginx, and the Gates Foundation. Other partners include the certificate authority IdenTrust, the University of Michigan, and the Linux Foundation.

The mission of the organization is to create a more secure and privacy-respecting World Wide Web by promoting the widespread adoption of HTTPS. Let's Encrypt certificates are valid for 90 days by default, during which renewal can take place at any time. Optionally, certificates can be issued which are valid for 45 days (tlsserver profile) and 6 days (shortlived profile). This is handled by an automated process designed to overcome manual creation, validation, signing, installation, and renewal of certificates for secure websites. The project claims its goal is to make encrypted connections to World Wide Web servers ubiquitous. By eliminating payment, web server configuration, validation email management and certificate renewal tasks, it is meant to significantly lower the complexity of setting up and maintaining TLS encryption. On a Linux web server, execution of only two commands is sufficient to set up HTTPS encryption and acquire and install certificates. To that end, a software package was included into the official Debian and Ubuntu software repositories. Current initiatives of major browser developers such as Mozilla and Google to deprecate unencrypted HTTP are counting on the availability of Let's Encrypt. The project is acknowledged to have the potential to accomplish encrypted connections as the default case for the entire Web. The service only issues domain-validated certificates, since they can be fully automated. Organization Validation and Extended Validation Certificates both require human validation of any registrants, and are therefore not offered by Let's Encrypt. Support of ACME v2 and wildcard certificates was added in March 2018. The domain validation (DV) utilized by Let's Encrypt dates back to 2002 and was at first controversial when introduced by GeoTrust before becoming a widely accepted method for the issuance of SSL certificates. By being as transparent as possible, the organization hopes to both protect its own trustworthiness and guard against attacks and manipulation attempts. For that purpose it regularly publishes transparency reports, publicly logs all ACME transactions (e.g. by using Certificate Transparency), and uses open standards and free software as much as possible.

The certificate authority consists of a piece of software called Boulder, written in Go, that implements the server side of the ACME protocol. It is published as free software with source code under the terms of version 2 of the Mozilla Public License (MPL). It provides a RESTful API that can be accessed over a TLS-encrypted channel. An Apache-licensed Python certificate management program called certbot (formerly letsencrypt) gets installed on the client side (the Web server of an enrollee).

This is used to order the certificate, to conduct the domain validation process, to install the certificate, to configure the HTTPS encryption in the HTTP server, and later to regularly renew the certificate. After installation and agreeing to the user license, executing a single command is enough to get a valid certificate installed. Additional options like OCSP stapling or HTTP Strict Transport Security (HSTS) can also be enabled. Automatic setup initially only works with Apache and nginx. As of October 2026, Let's Encrypt issues certificates valid for 90 days. The reason given is that these certificates "limit damage from key compromise and mis-issuance" and encourage automation. Starting February 10, 2027, Let's Encrypt plans to reduce certificate validity period to 64 days. Initially, Let's Encrypt developed its own ACME client – Certbot – as an official implementation. This has been transferred to Electronic Frontier Foundation and its name "letsencrypt" has been changed to "certbot". There is a large selection of ACME clients and projects for a number of environments developed by the community.

Official website Certbot Let's Encrypt on GitHub Seth Schoen's Libre Planet 2015 lecture on Let's Encrypt Peter Eckersley's talk on Let's Encrypt at CCCamp 2015 List of certificates issued by Let's Encrypt Let's Encrypt Stats – interactive charts of Let's Encrypt certificates issued per day The Commercial National Security Algorithm Suite (CNSA) is a set of cryptographic algorithms promulgated by the National Security Agency as a replacement for NSA Suite B Cryptography algorithms. It serves as the cryptographic base to protect US National Security Systems information up to the TOP SECRET level. Two versions of CNSA exist: the pre-quantum 1.0 of 2015 and the quantum-resistant 2.0 of 2022.

The CNSA 1.0 transition is notable for moving RSA from a temporary legacy status, as it appeared in Suite B, to supported status. It also did not include the Digital Signature Algorithm. This, and the overall delivery and timing of the announcement, in the absence of post-quantum standards, raised considerable speculation about whether NSA had found weaknesses e.g. in elliptic-curve algorithms or others, or was trying to distance itself from an exclusive focus on ECC for non-technical reasons.

Documents describing the integration of CNSA 1.0 with Internet protocols include: RFC 9151 Commercial National Security Algorithm (CNSA) Suite Profile for TLS and DTLS 1.2 and 1.3 RFC 9206 Commercial National Security Algorithm (CNSA) Suite Cryptography for Internet Protocol RFC 9212 Commercial National Security Algorithm (CNSA) Suite Cryptography for Secure Shell (SSH) RFC 8755 Using Commercial National Security Algorithm Suite Algorithms in Secure/Multipurpose RFC 8756 Commercial National Security Algorithm (CNSA) Suite Profile of Certificate Management over CMS RFC 8603 Commercial National Security Algorithm (CNSA) Suite Certificate and Certificate Revocation List (CRL) Profile Suggests separate post-quantum algorithms (XMSS/LMS) for software/firmware signing for use immediately Allows SHA-512 Announced the selection of CRYSTALS-Kyber and CRYSTALS-Dilithium early, with the expectation that they will be mandated only when the final standards and FIPS-validated implementations are released. RSA, Diffie-Hellman, and elliptic curve cryptography will be deprecated at that time.

Documents describing the integration of CNSA 2.0 with Internet protocols include: draft-becker-cnsa2-smime-profile-01 Commercial National Security Algorithm (CNSA) Suite Profile for Secure/Multipurpose Internet Mail Extensions (S/MIME) draft-becker-cnsa2-ssh-profile-02 Commercial National Security Algorithm (CNSA) Suite Profile for SSH draft-becker-cnsa2-tls-profile-02 Commercial National Security Algorithm (CNSA) Suite Profile for TLS 1.3 draft-guthrie-cnsa2-ipsec-profile-01 Commercial National Security Algorithm (CNSA) Suite 2.0 Profile for IPsec draft-jenkins-cnsa2-cmc-profile-01 Commercial National Security Algorithm (CNSA) Suite Profile of Certificate Management over CMS draft-jenkins-cnsa2-pkix-profile-03 Commercial National Security Algorithm Suite Certificate and Certificate Revocation List Profile Certificates are the backbone of trust on the internet and within enterprise networks. They authenticate servers, encrypt communications, sign code, verify device identities, and enable mutual TLS between services. Yet certificate management remains one of the most operationally challenging aspects of identity and security.

The consequences of poor certificate management are severe and immediate. An expired certificate causes an outage, your website goes down, your API stops working, your VPN becomes inaccessible. A compromised certificate enables man-in-the-middle attacks. An over-issued certificate expands your attack surface. These are not theoretical risks: certificate-related outages make headlines regularly, affecting organizations from airlines to cloud providers.

This guide provides a complete approach to certificate lifecycle management, from PKI design through automated renewal and revocation. The root CA is kept offline (not connected to any network) and is only used to sign intermediate CA certificates. The intermediate CAs are online and handle day-to-day issuance. If an intermediate CA is compromised, it can be revoked without replacing the root.

Manual certificate renewal does not scale and is the primary cause of certificate-related outages. Automate everything. When a private key is compromised or a certificate is no longer needed, revocation must happen immediately. CRLs are lists of revoked serial numbers that clients download periodically. They are simple but have drawbacks: the CRL can grow large, and there is a delay between revocation and the next CRL publish.

OCSP provides real-time revocation checking. The client sends the certificate's serial number to the OCSP responder and gets back a signed "good," "revoked," or "unknown" response. The most elegant revocation strategy is to not need revocation at all. If certificates are valid for only 24 hours (or less), a compromised certificate expires before an attacker can make meaningful use of it. This approach requires strong renewal automation but eliminates the complexity of CRL/OCSP infrastructure.

Certificate pinning adds a layer of defense by ensuring your application only trusts specific certificates or CAs, rather than any CA in the system trust store. Use pinning sparingly and always include a backup pin (for the next certificate you will rotate to). Pinning the wrong thing or failing to update pins before certificate rotation causes outages.

Certificate lifecycle management is an operational discipline, not a one-time project. Certificates are constantly being issued, renewed, and revoked. The organizations that avoid certificate-related outages are those that invest in automation, monitoring, and short certificate lifetimes. Start by gaining visibility: discover every certificate in your environment and monitor their expiry dates. Then automate renewal: use ACME for public certificates and Vault PKI or cert-manager for internal certificates. Finally, shorten lifetimes: move toward 90-day public certificates and 24-hour internal certificates. Each step reduces risk and operational burden.

Q: How short should certificate lifetimes be? A: As short as your automation can support. For public-facing TLS, 90 days (Let's Encrypt default) is standard. For internal services with strong automation, 30 days or less. For service mesh (SPIFFE/SPIRE), 1-24 hours. Q: Do I need a private CA? A: If you have internal services that communicate over mTLS, client certificate authentication, or code signing, yes. Public CAs issue certificates for public DNS names only. Internal services need a private CA.

Q: What about wildcard certificates? A: Wildcard certificates (*.example.com) are convenient but risky. A single compromised key exposes all subdomains. Use them at the edge (CDN, load balancer) where they reduce certificate count, but use specific certificates for individual services behind the load balancer. Q: How do I handle certificate rotation with zero downtime? A: Most web servers and load balancers support certificate reload without restart (NGINX: nginx -s reload , HAProxy: set ssl cert ). For applications, implement hot-reloading of TLS certificates from the filesystem or vault.

Q: What is ACME and should I use it? A: ACME (Automated Certificate Management Environment) is the protocol that Let's Encrypt uses for automated certificate issuance and renewal. You should use ACME for all public certificates and consider using it for private certificates too (step-ca supports ACME). 3. Software Implementation, Frameworks & Protocols Q: How do I prepare for post-quantum cryptography? A: Start by inventorying all certificates and their algorithms. Monitor NIST PQC standards. Test hybrid certificates (classical + PQC) when your CA supports them. Plan for a migration window of 3-5 years once PQC standards are finalized.

Certificate lifecycle management (CLM), often called certificate management, is the practice of discovering, issuing, renewing, and revoking X.509 certificates, Certificate management explained: discovery, issuance, renewal, and revocation across public and private PKI, why the CA/Browser Forum schedule to 47-day certif A complete guide to managing machine identities including certificates, service accounts, API keys, secrets rotation, PKI setup, and machine-to-machine authenti The best open-source PKI tools in 2026, from EJBCA and step-ca to Dogtag, cert-manager, OpenXPKI, and Boulder, compared on protocol support, automation, and who Complete guide to automating the user lifecycle from onboarding through role changes to offboarding, including orphan account detection and provisioning workflo A practical guide to automating API key rotation with zero downtime, covering rotation strategies, secrets management integration, dual-key patterns, monitoring Access to this page requires authorization. You can try signing in or changing directories .

Certificate revocation is how a certification authority (CA) withdraws trust from a certificate before it expires, such as when a private key is compromised or you no longer need a certificate. The CA records that decision and publishes it in a certificate revocation list (CRL) that relying parties retrieve from a CRL distribution point (CDP). But revocation doesn't take effect everywhere at once: relying parties keep trusting a certificate until they retrieve an updated CRL from a location they can reach. If publication or distribution breaks, a revoked certificate can stay usable.

This article shows how to use Active Directory Certificate Services (AD CS) to revoke certificates, publish CRLs, and change CDPs safely, including CDP transitions that don't strand previously issued certificates. Revocation isn't instantaneous at every relying party. A newly revoked certificate can remain usable to a relying party until that party retrieves a newer revocation response or CRL according to its validation and caching behavior. Treat publication and endpoint validation as part of the revocation operation.

The CA's CDP configuration represents both publication and retrieval settings. Get-CACrlDistributionPoint exposes that distinction through properties such as PublishToServer , PublishDeltaToServer , AddToCertificateCdp , and AddToFreshestCrl . Changing a CDP URL affects only certificates issued after the change. Previously issued certificates continue to reference the earlier URL. Keep the prior endpoint and current CRL content available until no unexpired certificate or CA certificate in scope references it.

Treat a revocation as an authorization and incident-response decision, not as routine cleanup. Separate the certificate-manager role that revokes a certificate from the CA-administrator role that changes CDPs, CRL timing, service state, and CA configuration. Require documented approval before you revoke, reinstate, or change a location that clients use to validate certificates.

Protect the CRL publication path against unauthorized writes, and restrict the copy or replication identity to the permissions it needs. At the same time, make the client-facing retrieval endpoint available to every relying party that must validate the affected certificates. A protected publication path doesn't replace a reachable retrieval URL. Use the reason that most accurately describes why you can no longer trust the certificate. The reason is part of the signed revocation data and helps incident responders understand the decision.

Those reasons are the codes documented for the CA administration interface that the Certification Authority console uses. The certutil -revoke command also accepts privilege withdrawn and AA compromise. Use one of those extra codes only when your revocation policy requires it and you confirm how your relying parties interpret it. The reason doesn't create an exception at the relying party. After a relying party consumes valid revocation data that contains the serial number, it treats the certificate as revoked according to its validation policy.

Record the revocation decision in the issuing CA database, then publish updated revocation data so that relying parties can act on it. You can reinstate only a certificate that you revoked with the Certificate Hold reason. You can't reinstate a certificate that you revoked for any other reason. Don't use a hold as a routine retry mechanism or to reverse a key-compromise decision.

A reinstated certificate no longer appears in CRLs that the CA publishes after the reinstatement. Until relying parties retrieve that newer revocation data, they can continue to treat the certificate as revoked. To publish a CRL manually from Revoked Certificates , select Action > All Tasks > Publish , and then select the appropriate CRL type. Use the console when your operational process requires an interactive confirmation.

For a scripted or documented CA operation, run the following command from an elevated command prompt. It publishes the base and delta CRLs when you configure delta CRLs for the CA. Use certutil as an administrative inspection and management tool, not in production application code. Microsoft doesn't provide live-site support or application-compatibility guarantees for that use.

certutil -CRL writes new CRL data according to the CA configuration; it doesn't prove that a web server, replication process, or external transfer makes the new files available. After publishing, verify the publication path, the transfer or replication job, and the retrieval endpoint separately. Set the base CRL interval, delta CRL interval, validity interval, and overlap based on your certificate population, expected revocation urgency, endpoint capacity, replication or transfer delay, client connectivity, and monitoring response time. Don't adopt another organization's schedule without measuring those constraints.

For an offline root CA, avoid delta CRLs unless a documented requirement justifies them. Use a scheduled, witnessed process to publish a new base CRL, transfer it to every retrieval endpoint, and verify it from the networks that depend on the root. Monitor more than the CA publication result. At each HTTP endpoint, verify that the expected CRL file is current, complete, and readable by the intended clients. Configure the web server with the .crl MIME mapping required by your web-server policy, and verify the actual HTTP response after deployment. At LDAP or file-based publication locations, verify the directory replication or file-transfer result and the permissions used by the publishing process.

Alert before a CRL reaches its next-update boundary. Your response procedure should identify whether the failure is in CA generation, the publication path, the copy or replication process, DNS or network reachability, or the retrieval service. Use a staged transition. Add and validate the new endpoint before you remove an old one. Run the following command on the target CA and save the result with the change record.

Don't assume that a local folder or a UNC path is suitable as a client-facing CDP. Publish an HTTP CRL location so that clients outside the organization and clients that don't run Windows can validate certificates, and use LDAP where your domain design requires it. Windows clients try the URLs in a certificate's CDP extension in order until they retrieve a valid CRL. Account for that order when you add a URL that clients in some networks can't reach.

The following example separates the local publication path from the HTTP URL embedded in newly issued certificates. It also advertises the HTTP location for delta CRLs. Use the existing CA naming convention and omit delta-related switches when the CA doesn't publish delta CRLs. Compare the planned entries against the Get-CACrlDistributionPoint output first. A newly installed CA already has default publication and retrieval entries, and adding a URI that's already configured with the same flags creates a duplicate.

4. Practical Deployment, Analysis & Case Studies Add-CACrlDistributionPoint prompts for confirmation. Add -Force only when your change process authorizes an unattended run. The cmdlets update CA configuration; they don't create a web publication service or copy files to an HTTP server. Make the required web-server and transfer changes, then check the command result. If it reports that the CA requires a restart, restart the CA service during the approved change window before you issue certificates that should carry the new CDP.

Publish new CRLs after the restart, then verify that the new files are present at the publication and retrieval locations. Inspect the certificate's CRL Distribution Points extension and confirm that it contains the new retrieval URL. From each representative network zone, validate the test certificate and retrieve its revocation data: Confirm that the output shows a successful retrieval of the base CRL and, when you use delta CRLs, of the associated delta CRL.

Repeat the retrieval test against a certificate issued before the change. Verify that it still retrieves revocation data from the previous CDP. Confirm that a representative relying party detects the revocation after it obtains the updated data. Leave the old endpoint in service until you show that no unexpired end-entity or CA certificate in scope refers to it. This scope includes long-lived CA certificates and certificates outside the network where you made the change.

After the retention decision, use -WhatIf before removing the old URI. Include only the flags that match the CDP entry you intend to remove. If you omit the flags, the cmdlet removes every distribution point that matches the URI. Review the result, remove -WhatIf only when the change record authorizes the action, restart the CA service if the operation requires it, publish fresh CRLs, and repeat the validation matrix. Removing an endpoint from the CA configuration doesn't remove it from certificates that already contain it.

Ensuring your certificate validation statuses match the status of the certificate on the CA is important. If a CRL expires or is unavailable, it can cause multiple system outages for all systems with certificates that rely on that CRL Distribution Point (CDP) for verification. Trust Protection Foundation checks the CDPs on a scheduled basis to verify that the endpoint is active. If a CDP goes down, you need to take immediate action to prevent outages. The Trust Protection Foundation Certificate Revocation List (CRL) Verification Service verifies CRLs to ensure that they are valid and available for revocation checking. If a CRL is within a configurable time-period prior to expiration, the service sends a notification to one or more administrators so that they can ensure it is updated.

The CRL Verification Service checks CRLs on each CDP on which they are located. To accomplish this, the CDP location information for each verified CRL is configured in Trust Protection Foundation on CA certificates in the Policy Tree Roots tree. CDP information is added to Trust Protection Foundation in three ways: New CA Certificate: When a CA certificate is added to the Roots tree, Trust Protection Foundation checks the certificates in the Policy tree that have been issued by that CA and adds any discovered CDPs to the CA certificate object.

The time-frame prior to the NextUpdate date when the CRL Verification Service will send notification warning of expiration is configurable using the Expiry Notification Percentage. The Expiry Notification Percentage is a percentage of the CRL validity period ( Published Date to NextUpdate ) and is used to determine how long before CRL expiration that the CRL Verification Service should send expiration warning notifications.

NOTE The Next Update attribute is functionally the expiration date of the CRL. Thus, you can extrapolate the validity period of the CRL by subtracting the Published Date from the Next Update . This percentage is set at the root of the Roots tree (to apply to all CA certificates) or on individual CA certificates (overriding the value set at the root). Each time that the CRL Verification service runs, it connects to each CDP, retrieves the CRL, and calculates the amount of time until the NextUpdate date. If that time is less than the Expiry Notification Percentage, a notification is sent.

Trust Protection Foundation CRL Verification service supports the following URL formats for CDPs: Trust Protection Foundation expects all endpoints to be configured for anonymous authentication. When Trust Protection Foundation is installed on a Windows server that is joined to a domain, Trust Protection Foundation leverages the permissions of the account that VPlatform is running under if a FILE endpoint requires authentication.

Access to this page requires authorization. You can try signing in or changing directories . A CRL (Certificate Revocation List) is a list of digital certificates that have been revoked by the CA (Certificate Authority) before their scheduled expiration date. A digital certificate is used to verify the identity of a user, computer, or other entity in a networked environment.

If a certificate based authentication method, like EAP-TLS or PEAP-TLS, is used the client sends certificates to the Network Policy Server (NPS). By default, the NPS checks the revocation status for all certificates in the certificate chain. If the certificate revocation check fails for any of the certificates in the chain, the connection attempt is denied. A CA publishes the information about revoked certificates in a CRL.

Certificate revocation checking can prevent client access if the CRL for any certificate in the certificate chain has expired or is unavailable. Avoid that by designing your public key infrastructure (PKI) for high availability of CRLs. For example, configure multiple CRL distribution points for each CA in the certificate hierarchy and configure publication schedules that ensure that the most current CRL is always available. Certificate revocation checking is only as accurate as the CRL on the NPS. CRLs are published by the CA based on a schedule that can be configured and cached on an NPS server for the time they're valid.

If a certificate gets revoked, the new CRL, containing the newly revoked certificate, isn't automatically published. Also, the CRL on the NPS server isn't updated as long as the cached CRL is valid. The revoked certificate can still be used to authenticate until the new CRL is published by the CA and updated on the NPS. To prevent this from occurring, the network administrator must manually publish the updated CRL and manually update the CRL on the NPS Server. Ask your PKI administrator for how to publish the new CRL.

When using certificates for computer or user authentication, ensure that the CRLs are published in a primary and at least one secondary location that are accessible by all computers, especially all NPS and other RADIUS servers. If the NPS servers attempts to perform CRL validation of user or computer certificates, but cannot locate the CRLs, the NPS server rejects all certificate-based connection attempts and authentication fails.

The certificate revocation check for a certificate can fail for the following reasons: The CRL for the certificate can't be reached or isn't available. CAs maintain CRLs and publish them to CRL distribution points (CDP). The CDPs are included in the 'CRL Distribution Points' property of the certificate. If the CDPs can't be contacted the certificate revocation check fails, the access request is denied. If there are no CDPs in the certificate, revocation check fails and the access request is denied.

The publisher of the CRL didn't issue the certificate. Included in the CRL is the publishing CA. If the publishing CA of the CRL doesn't match the issuing CA for the certificate being checked, the certificate revocation check fails, the access request is denied. The CRL isn't current. A CRL is only valid for a limited time. If the CRL is expired, the CRL is considered invalid and the certificate revocation check fails, the access request is denied. New CRLs must be published before the expiration date of the last published CRL.

The behavior of the certificate revocation check on the NPS can be modified with registry settings. For more information on editing these settings, see Configure Network Policy Server Certificate Revocation List check registry settings . A CRL is a signed list of certificates that a CA has revoked before their expiration date. Think of it as a cancelled passport list: authorities publish it so that anyone checking a passport can verify it hasn't been invalidated. This guide explains how CRLs work, how they compare to OCSP, and best practices for managing them.

A Certificate Revocation List (CRL) is a digitally signed data structure published by a certificate authority (CA) that lists the serial numbers of certificates that have been revoked before their natural expiration date. The CRL format is defined in RFC 5280 as part of the X.509 standard . Each CRL entry contains the certificate's serial number, the revocation date, and optionally a reason code. The entire list is signed by the CA's private key, so clients can verify its authenticity.

Think of a CRL like the list of cancelled credit cards that merchants used to receive: a periodically updated document that says "these credentials are no longer valid, even though they haven't expired yet." Clients download the CRL and check incoming certificates against it. The CA periodically generates a new CRL containing all currently revoked certificates. The CRL is signed with the CA's private key and published at a URL called the CRL Distribution Point (CDP). The CDP URL is embedded in every certificate the CA issues.

5. Performance Evaluation & Extended Technical Observations When a client (browser, application, or server) needs to verify a certificate, it reads the CDP from the certificate and downloads the CRL. The client then verifies the CA's signature on the CRL to ensure it hasn't been tampered with. The client searches the CRL for the certificate's serial number. If found, the certificate is revoked and the connection is rejected. If not found, the certificate passes the revocation check.

Each CRL has a nextUpdate field indicating when a new CRL will be published. Clients cache the CRL until this time, avoiding repeated downloads. The trade-off: during the cache period, newly revoked certificates won't be detected. A new certificate has been issued to replace this one. The old certificate is revoked to prevent two valid certificates from coexisting for the same identity.

CRLs only grow: every revoked certificate adds an entry until the certificate's original expiration date passes. A busy CA can produce CRLs that are megabytes in size. Clients must download the entire list even if only one entry changed. Large CRLs consume significant bandwidth, especially when many clients download them simultaneously after a nextUpdate window expires. This creates traffic spikes on the CDP infrastructure and adds latency to certificate validation.

Between CRL publications, newly revoked certificates are invisible to clients using cached CRLs. If the CRL is published every 24 hours, a compromised certificate could remain trusted for up to 24 hours after revocation. This is the fundamental trade-off of CRL's batch model. Delta CRLs (RFC 5280) address the size problem by publishing only changes since the last full CRL. However, they add significant complexity: clients must track base CRL numbers, handle delta references, and manage cache coherency. Many implementations don't support them.

Automated CRL and OCSP — Evertrust PKI automatically publishes CRLs on configurable schedules and provides a built-in OCSP responder. Both are managed without manual intervention, ensuring revocation information is always fresh and available. Revocation visibility — Evertrust CLM tracks the revocation status of every discovered certificate across all your CAs. See which certificates have been revoked, when, and why, from a single dashboard.

Revocation + replacement workflow — When you revoke a certificate in Evertrust, you can automatically trigger the issuance and deployment of a replacement certificate, minimizing the time your service runs without a valid certificate. October 25, 2024: This post has been updated to include a reference to a sample implementation published on the AWS Samples GitHub repository .

As you design your Amazon API Gateway applications to rely on mutual certificate authentication ( mTLS ), you need to consider how your application will verify the revocation status of a client certificate. In your design, you should account for the performance and availability of your verification mechanism to make sure that your application endpoints perform reliably. In this blog post, I demonstrate an architecture that will help you on your journey to implement custom revocation checks against your certificate revocation list (CRL) for API Gateway. You will also learn advanced Amazon Simple Storage Service (Amazon S3) and AWS Lambda techniques to achieve higher performance and scalability.

One of your first considerations is whether to use a CRL or the Online Certificate Status Protocol (OCSP) , if your certificate authority (CA) offers this option. For an in-depth analysis of these two options, see my earlier blog post, Choosing the right certificate revocation method in ACM Private CA . In that post, I demonstrated that OCSP is a good choice when your application can tolerate high latency or a failure for certificate verification due to TLS service-to-OCSP connectivity. When you rely on mutual TLS authentication in a high-rate transactional environment, increased latency or OCSP reachability failures may affect your application. We strongly recommend that you validate the revocation status of your mutual TLS certificates.

Verifying your client certificate status against the CRL is the correct approach for certificate verification if you require reliability and lower, predictable latency. A potential exception to this approach is the use case of AWS Certificate Manager Private Certificate Authority (AWS Private CA) with an OCSP responder hosted on AWS CloudFront . With an AWS Private CA OCSP responder hosted on CloudFront, you can reduce the risks of network and latency challenges by relying on communication between AWS native services. While this post focuses on the solution that targets CRLs originating from any CA, if you use AWS Private CA with an OCSP responder, you should consider generating an OCSP request in your Lambda authorizer .

API Gateway mutual TLS authentication (mTLS) requires you to define a root of trust that will contain your certificate authority public key. During the mutual TLS authentication process, API Gateway performs the undifferentiated heavy lifting by offloading the certificate authentication and negotiation process. During the authentication process, API Gateway validates that your certificate is trusted, has valid dates, and uses a supported algorithm. Additionally, you can refer to the API Gateway documentation and related blog post for details about the mutual TLS authentication process on API Gateway.

In the remainder of this blog post, I’ll describe the architecture for a scalable implementation of a client certificate verification mechanism against a CRL on your API Gateway. The certificate CRL verification process presented here relies on a custom Lambda authorizer that validates the certificate revocation status against the CRL. The Lambda authorizer caches CRL data to optimize the query time for subsequent requests and allows you to define custom business logic that could go beyond CRL verification. For example, you could include other, just-in-time authorization decisions as a part of your evaluation logic.

This section describes the implementation mechanisms that help you create a high-performing extension to the API Gateway mutual TLS authentication process. API Gateway mutual TLS configuration uses Amazon S3 as a repository for your root of trust. The design for this sample implementation extends the use of S3 buckets to store your CRL and the public key for the certificate authority that signed the CRL.

We strongly recommend that you maintain an updated CRL and verify its signature before data processing. This process is automatic if you use AWS Private CA, because AWS Private CA will update your CRL automatically on revocation. AWS Private CA also allows you to retrieve the CA’s public key by using an API call. My sample implementation architecture uses the API Gateway Lambda authorizer to validate the serial number of the client certificate used in the mutual TLS authentication session against the list of serial numbers present in the CRL you publish to the S3 bucket. In the process, the API Gateway custom authorizer will read the client certificate serial number, read and validate the CRL’s digital signature, search for the client’s certificate serial number within the CRL, and return the authorization policy based on the findings.

The mechanisms that enable a predictable, low-latency performance are CRL preprocessing and caching. Your CRL is an ASN.1 data structure that requires a relatively high computing time for processing. Preprocessing your CRL into a simple-to-parse data structure reduces the computational cost you would otherwise incur for every validation; caching the CRL will help you reduce the validation latency and improve predictability further.

The process of parsing and validating CRLs is computationally expensive. In the case of large CRL files, parsing the CRL in the Lambda authorizer on every request can result in high latency and timeouts. To improve latency and reduce compute costs, this solution optimizes for performance by preprocessing the CRL and implementing function-level caching. The first optimization happens when S3 receives a new CRL object. As shown in Figure 1, the S3 PutObject event invokes a preprocessing Lambda that validates the signature of your uploaded CRL and decodes its ASN.1 format. The output of the preprocessing Lambda function is the list of the revoked certificate serial numbers from the CRL, in a data structure that is simpler to read by your programming language of choice, and that won’t require extensive parsing by your Lambda authorizer.

The asynchronous approach mitigates the impact of CRL processing on your API Gateway workload. The optimization happens as part of your Lambda authorizer that retrieves the preprocessed CRL data generated from the first step and searches through the data structure for your client certificate serial number. If the Lambda authorizer finds your client’s certificate serial number in the CRL, the authorization request fails, and the Lambda authorizer generates a “Deny” policy. Searching through a read-optimized data structure prepared by your preprocessing step is the second optimization that reduces the lookup time and the compute requirements.

Because of the preprocessing, the Lambda authorizer code no longer needs to perform the expensive operation of decoding the ASN.1 data structures of the original CRL; however, network transfer latency will remain and may impact your application. To improve performance, and as a third optimization, the Lambda service retains the runtime environment for a recently-run function for a non-deterministic period of time. If the function is invoked again during this time period, the Lambda function doesn’t have to initialize and can start running immediately. This is called a warm start . Function-level caching takes advantage of this warm start to hold the CRL data structure in memory persistently between function invocations so the Lambda function doesn’t have to download the preprocessed CRL data structure from S3 on every request.

The duration of the Lambda container’s warm state depends on multiple factors, such as usage patterns and parallel requests processed by your function. If, in your case, API use is infrequent or its usage pattern is spiky, pre-provisioned concurrency is another technique that can further reduce your Lambda startup times and the duration of your warm cache. Although provisioned concurrency does have additional costs, I recommend you evaluate its benefits for your specific environment. You can also check out the blog dedicated to this topic, Scheduling AWS Lambda Provisioned Concurrency for recurring peak usage .

To validate that the Lambda authorizer has the latest copy of the CRL data structure, the S3 ETag value is used to determine if the object has changed. The preprocessed CRL object’s ETag value is stored as a Lambda global variable, so its value is retained between invocations in the same runtime environment. When API Gateway invokes the Lambda authorizer, the function checks for existing global preprocessed CRL data structure and ETag variables. The process will only retrieve a read-optimized CRL when the ETag is absent, or its value differs from the ETag of the preprocessed CRL object in S3.

In summary, you will have a Lambda container with a persistent in-memory lookup data structure for your CRL by doing the following: The sample implementation flow diagram in Figure 3 demonstrates the overall architecture of the solution. If you are interested in a sample implementation of the architecture described in this post, you can find it in the AWS Samples public repository for api-gateway-crl-verification . This repository includes sample code for the components mentioned in the post, an AWS CloudFormation template, and additional diagrams to help you deploy the sample in your development environment.

In this post, I presented a design for validating your API Gateway mutual TLS client certificates against a CRL, with support for extra-large certificate revocation files. This approach will help you align with the best security practices for validating client certificates and use advanced S3 access and Lambda caching techniques to minimize time and latency for validation. Harvested Online Documentation & Reference Sources • https://en.wikipedia.org/wiki/Certificate%20authority • https://en.wikipedia.org/wiki/Let%27s%20Encrypt • https://en.wikipedia.org/wiki/Commercial%20National%20Security%20Algorithm%20Suite • https://startwithidentity.com/guides/machine-identity/certificate-lifecycle-management-guide/ • https://learn.microsoft.com/en-us/windows-server/identity/ad-cs/operate-certificate-revocation-crl-cdp • https://docs.venafi.com/Docs/current/TopNav/Content/CRL/c-CRL-validatingCertRevocationLists.php • https://learn.microsoft.com/en-us/windows-server/networking/technologies/nps/network-policy-server-certificate-revocation-li st-overview • https://evertrust.io/guide/crl/ • https://aws.amazon.com/blogs/security/how-to-implement-client-certificate-revocation-list-checks-at-scale-with-api-gateway/