What is certificate revocation?

Short answer

Certificate revocation is the CA declaring invalid a certificate that has become untrustworthy before its expiry (its key has been compromised, the information it contains has changed or it is no longer used). Revocation information reaches clients in two ways: the CRL (Certificate Revocation List) that the CA publishes, or a real-time OCSP query; in OCSP Stapling, the server performs this query and adds the response to the handshake. In TR7, revocation is encountered in the OCSP Stapling setting in the TLS Security Profile, for conveying to the client the status of the certificate that the vService presents; the certificates issued by the internal CA are monitored with Status on the Issued Certificates (Internal PKI) tab.

Where It Is Used in TR7

Where	Field / label	What for
Certificates & PKI → TLS Security Profiles → Frontend-only Settings	OCSP Stapling	Conveying to the client the status response (good, revoked) for the vService certificate, obtained from the CA
Certificates & PKI → SSL/TLS Certificates → Issued Certificates (Internal PKI)	Status: Active, Superseded	Whether a certificate issued by the internal CA is in use or has been replaced by a new one
SSL/TLS Certificates → right-click	Renew Now (internal CA)	Re-issuing an internal CA certificate immediately with a new key and a new serial number

How Does It Work?

• CRL: The CA periodically publishes the serial numbers of the certificates it has revoked in a signed list; the client downloads the list and searches it for the serial number of the certificate (RFC 5280).
• OCSP: The client (or, in stapling, the server) asks the CA's OCSP responder for the status of a single certificate and receives a signed response (RFC 6960).
• In the certificate, the CRL and OCSP addresses are carried in the CRL Distribution Points and AIA extensions.

TR7's internal CA does not publish a CRL or OCSP; the lifetime of the certificates issued with the internal CA is limited by Lifetime (days) in Certificate Profiles, and a certificate whose security is compromised is re-issued with a new key using Renew Now (internal CA) (Can I use TR7 as an internal CA to issue, automatically renew and revoke certificates?).

Common Misconceptions

• "A certificate that has not expired is always valid." The CA can revoke it before its expiry; the client learns this with CRL or OCSP.
• "Renewing a certificate revokes the old one." Renewal produces a new certificate; unless the old certificate is revoked separately, it stays cryptographically valid until it expires. Therefore, the revocation of a certificate belonging to a compromised key is requested from the CA that issued it.
• "OCSP Stapling blocks a revoked certificate." Stapling only conveys the status response; the certificate must be replaced (What are OCSP and OCSP Stapling?).

How it is done in the documentation

• SSL/TLS Certificates · Issued Certificates (Internal PKI) Tab
• TLS Security Profiles · OCSP Stapling
• SSL/TLS Certificates · Right-Click Menu

Related questions

• Can I use TR7 as an internal CA to issue, automatically renew and revoke certificates?
• What are OCSP and OCSP Stapling?
• What is the difference between renewing a certificate and rekeying it?