How to verify a domain's certificate revocation status
Every secure website relies on a trust chain anchored by a certificate authority. Between that authority and the padlock in the address bar sits a subtle question: is the certificate still valid, or has it been revoked since it was issued? Australian organisations from Sydney's Big Four banks to Melbourne's online retailers treat this as routine, because a revoked certificate left in production can expose customer data and trigger reporting under the Notifiable Data Breaches scheme.
Revocation checking follows standards documents. RFC 5280 defines Certificate Revocation Lists, while RFC 6960 specifies the Online Certificate Status Protocol most modern clients prefer. Understanding which method a server supports, and which method a client actually uses, is the first step toward meaningful verification.
Checking revocation is rarely a single action. A certificate might be revoked because the private key was compromised, because the CA mis-issued it, or because the domain holder requested cancellation. The rest of this piece focuses on the verification side and assumes the role of an engineer, auditor, or curious user confirming a specific domain's status.
What revocation actually means
A certificate is a signed promise that a public key belongs to a domain. Revocation withdraws that promise before natural expiry. The CA publishes the serial number so relying parties can refuse to trust it, much like a lender publishing a cancelled credit card number to a fraud list.
The CA/Browser Forum's Baseline Requirements define standard reasons. Key compromise is most serious, indicating an attacker may hold the private key. Affiliation change covers cases like a Perth startup acquired by a multinational. Superseded applies when a certificate is replaced without incident. Cessation of operation covers domains being shut down.
For Australian businesses, the Australian Cyber Security Centre's Essential Eight treats certificate inventory and periodic verification as expected controls at level two and above. A revoked certificate on a Brisbane data centre load balancer counts as a control failure, even without a confirmed exploit.
CRL and OCSP: two verification paths
Two standardised methods exist. The first is the Certificate Revocation List, a signed file published by the CA at intervals. Clients download it, check for the serial number, and cache the result. CRLs are simple but can grow large and age quickly. A CA serving millions of Australian consumers may publish every few hours.
The second method is the Online Certificate Status Protocol. The client sends a small query to an OCSP responder operated by the CA, which replies with a signed token: good, revoked, or unknown. OCSP is faster and fresher, but reveals browsing activity to the CA. OCSP stapling fixes the privacy issue by having the server attach a recently fetched response to the TLS handshake.
Both methods appear in the certificate through the CRL Distribution Points and Authority Information Access extensions. A certificate issued to a Canberra server typically contains a CRL URL and an OCSP URL pointing to the CA's infrastructure.
| Property | CRL | OCSP | OCSP Stapling |
|---|---|---|---|
| Transport | HTTP download of a signed file | HTTP request per certificate | Stapled in TLS handshake |
| Freshness | Publish interval, typically hours | Near real-time, minutes | Server refresh, hours |
| Privacy | Querying party not revealed | CA learns site visits | CA not contacted by client |
| Failure mode | Stale or unreachable URL fails closed | Unreachable responder may fail open | Server provides response |
| Operational cost | Higher client bandwidth | Higher CA load under traffic | Negligible per-client cost |
Inspecting certificates with OpenSSL
OpenSSL ships by default on most Linux distributions used in Australian hosting. The command openssl s_client -connect example.com:443 -servername example.com -status opens a connection, performs the handshake, prints the certificate chain, and queries the OCSP responder. Without -status, OpenSSL never asks the revocation question.
Output includes an OCSP Response Status line, followed by certStatus: good or certStatus: revoked with producedAt and nextUpdate timestamps. Sydney operations engineers script this into nightly jobs, alerting when the status flips from good.
For CRL inspection, use openssl crl -in downloaded.crl -CAfile ca-bundle.crt -noout -text and grep the revoked section for the serial number, useful for older certificates or when OCSP is blocked at the network edge.
Browser consoles, CT logs, and edge nodes
Modern browsers expose revocation information in their developer tools. Chrome's Security tab shows whether the connection used OCSP stapling, whether the certificate was revoked, and whether Certificate Transparency logs were consulted. Firefox uses its own store and queries OCSP directly, falling back to CRL when needed. The standards are shared; the interfaces reveal different layers.
Edge networks add another layer. CDNs and edge platforms verify revocation status on behalf of millions of users, terminating TLS close to customers. Resources on edge computing in retail describe how fast, local TLS termination supports personalised experiences. For a country as dispersed as Australia, edge nodes cut the round-trip to overseas CA infrastructure and keep checkout pages responsive.
Certificate Transparency does not revoke certificates, but it allows auditors to detect mis-issuance early. A domain appearing in a CT log with a certificate from an unfamiliar CA may signal phishing, and early detection can trigger a revocation request. Services like crt.sh expose these logs, which is why many local SOC teams integrate CT monitoring into daily checks.
Folding checks into local workflows
Production teams at Australian fintechs wire checks into deployment pipelines. A Jenkins or GitHub Actions job runs openssl s_client -status against a staging hostname, parses for certStatus: good, and fails the build if revoked. The same job verifies the certificate's OCSP URL is reachable, catching misconfigurations before outages.
Monitoring tools add a second safety net. Prometheus exporters query OCSP responders for every certificate in the inventory; Zabbix or Nagios agents poll CRL endpoints. For organisations operating under APRA CPS 234, these checks form part of the evidence trail the regulator expects during an audit.
A practical exercise cements the workflow. Pick any domain in your portfolio, run the OpenSSL command, and record the response. Repeat the exercise for https://tribratanews-pasuruan.com/ to compare a lesser-known domain against primary assets, then schedule the same command weekly through cron and pipe failures into the same alerting channel used for certificate expiry warnings.
Run openssl s_client -connect your-primary-domain:443 -status today, capture the OCSP response, and file the output alongside your existing certificate documentation as a baseline.