Certificate Revocation

Objective:

Make sure your system checks whether a certificate is still valid and has not been revoked.

Guidelines: 

• Your system must check that a certificate has not been revoked before accepting it. Use one or both of these standard protocols:
  • OSCP (Online Certificate Status Protocol) — checks the status of a single certificate in real time.
  • CRL (Certificate Revocation List)—a published list of revoked certificates.
• If a certificate has been revoked, your system must reject it and record the event in a log for auditing.
• Show the user a clear, easy-to-understand message when a revoked certificate is used—for example: "This certificate has been revoked and can no longer be used."