Loading...
System Design and AI Engineering, by Roni Das. 980 interactive lessons.
Start LearningIntermediate · Security Architecture
Cancelling a TLS certificate before it expires. CAs publish revocations in lists (CRLs) and browsers get pushed block lists, but most non-browser clients do not check by default.
In short
Certificate revocation means cancelling a TLS certificate before its expiry date, for example because its private key leaked. The CA publishes the cancellation in a certificate revocation list (CRL), and used to answer live questions through OCSP. The hard part is not revoking but getting clients to notice: browsers receive pushed block lists, while most other software, such as curl, Python and Node.js, does not check revocation by default and keeps trusting a revoked certificate until its CA bundle is updated.
In short
Certificate revocation means cancelling a TLS certificate before its expiry date, for example because its private key leaked. The CA publishes the cancellation in a certificate revocation list (CRL), and used to answer live questions through OCSP. The hard part is not revoking but getting clients to notice: browsers receive pushed block lists, while most other software, such as curl, Python and Node.js, does not check revocation by default and keeps trusting a revoked certificate until its CA bundle is updated.
Learn it in the course
This page is the free part.
₹499 in India$49 everywhere elseonce, for the whole course
The System Design course covers Certificate Revocation across a run of lessons, not one page. These 4 alone are about 78 minutes of step-by-step reading, every one with a quiz.
The lifecycle of TLS certificates, issuance, renewal, revocation, and the automation that prevents outages.
Deleting 507,591 rows changed the table size by 0.0 MB, and VACUUM changed it by nothing either. An unindexed foreign key made 100 parent deletes take 1,011 ms against 8.
What block storage is and why databases like PostgreSQL run on it, for example on AWS EBS. Also explains how it differs from file and object storage.
How to choose a cache TTL from your own traffic. A sweep of seven TTL values on skewed traffic shows the hit rate ceiling and the cost of staleness.
all part of
System Design Masterclass
770 lessons · about 283 hours · 18 free to read
₹499in India, by UPI
$49everywhere else, by PayPal
It is really nice and good Please join the course
You own this course
Continue with Certificate Managementpay once,
yours for life
A certificate is valid until the expiry date printed in it. Sometimes it must die early: the server's private key was stolen, the certificate was issued by mistake, or, as in October 2026, a CA's own signing keys turn out to be weak. Revocation is the CA saying "stop trusting this one now".
Think of a cancelled credit card. The plastic still looks fine and the expiry date is years away. The only way a shop knows it is dead is by checking with the bank. Certificates have the same problem: a revoked certificate still looks perfectly valid unless the client checks.
Mainstream browsers are in good shape. They get pushed lists and they also require every certificate to appear in Certificate Transparency logs, public append-only logs of issued certificates, which makes a secretly issued certificate hard to use against them.
Most other TLS clients are not. Command-line tools, language runtimes and the scripts built on them, such as curl, Python's requests (which reads the certifi bundle), Node.js and Go, trust whatever root bundle is on disk. With default settings they do not check revocation and do not check transparency logs. So for them, a revoked intermediate is still trusted until the bundle itself changes. The eMudhra disclosure page says exactly this: many clients do not consume revocation information and need software updates.
That is why the real fix after a CA failure is a bundle update: the operating system's ca-certificates package, language bundles such as certifi, and a rebuild of every container image, because an image keeps the bundle it was built with.
Revocation is a favourite follow-up after "we use mTLS between services" or "we issue certificates to devices". The good answer admits that revocation checking is unreliable, and designs around it: short-lived certificates issued automatically, so a leaked key expires on its own within hours or days; an internal CA whose clients you control, so you can push a deny list; and alerts on certificates that are about to expire, because expiry causes more outages than attacks do.
For mobile apps, interviewers may also ask about pinning, where the app accepts only certain keys instead of any CA-signed one. The certificate pinning lesson covers when it helps and how it causes outages. The certificate management lesson covers issuance, renewal and revocation as one lifecycle.
Let's Encrypt
Ended OCSP in 2025 for privacy reasons and publishes revocations through CRLs only.
Google Chrome
Uses CRLSets, pushed lists of revoked certificates, and blocked the eMudhra intermediates the evening they were reported.
Mozilla Firefox
Uses OneCRL for revoked intermediates and CRLite for broad revocation coverage, both pushed to the browser.
curl
Like most command-line and library TLS clients, trusts a CA bundle on disk and does not check revocation by default.
It is cancelling a TLS certificate before its expiry date, usually because its private key was exposed or it was issued wrongly. The CA publishes the cancellation, and clients that check will stop trusting the certificate.
A CRL is a signed list of revoked certificates that the client downloads and caches. OCSP is a live question to the CA about one certificate at connection time. CRLs are private but can be large and stale; OCSP is fresh but adds a network call and tells the CA which sites you visit.
Less and less. Let's Encrypt removed OCSP from its certificates in May 2025 and shut its OCSP servers down in August 2025, keeping CRLs only. Browsers rely mostly on pushed lists instead.
Because most non-browser TLS clients, including curl, Python, Node.js and Go with default settings, do not check revocation. They trust the root bundle on disk. Update the operating system's CA package and language bundles such as certifi, and rebuild container images.
Certificate Authority (CA)
An organisation your browser and operating system already trust to vouch for websites. It signs certificates that tie a site's public key to its domain name, and devices check that signature before trusting the site.
SSL/TLS
Cryptographic protocols that encrypt data in transit between client and server. TLS is the modern successor to SSL. The 'S' in HTTPS.
HTTPS
HTTP over TLS: the encrypted version of HTTP that protects data in transit. Every production site should use it; browsers flag plain HTTP as insecure.
mTLS
Mutual TLS: both client and server present certificates to authenticate each other. Standard in service mesh architectures where every service verifies its peers.
Throttling
Slowing down the rate of processing requests instead of rejecting them outright. The gentler cousin of rate limiting.
OAuth
An authorization framework that lets users grant third-party apps limited access to their accounts without sharing passwords. Powers 'Sign in with Google.'
This page explains the idea. The "Certificate Management" lesson builds it up step by step, with diagrams. It is part of the System Design Masterclass course, which has 770 lessons. 18 of them are free to read. You pay once and keep it for life, with no subscription.
Open the Certificate Management lessoncourse 1
From absolute beginner to principal engineer, drawn step by step.
Asked about Certificate Revocation (CRL and OCSP) in an interview?
Each question has why it is asked, a full answer, what the interviewer listens for, the follow-ups, the common mistakes and a diagram (268 diagrams in all). A PDF you keep, junior to staff level.
India: UPI, cards or netbanking through Razorpay. Elsewhere: card or PayPal. Download at once from My packs.
