Certificate Revocation

Objective: 

 Make sure your system checks whether a certificate is still valid and has not been revoked. 

 Guidelines:  

 

 Your system must check that a certificate has not been revoked before accepting it. Use one or both of these standard protocols:

 

 OSCP (Online Certificate Status Protocol) — checks the status of a single certificate in real time. 

 CRL (Certificate Revocation List)—a published list of revoked certificates. 

 

 

 If a certificate has been revoked, your system must reject it and record the event in a log for auditing. 

 Show the user a clear, easy-to-understand message when a revoked certificate is used—for example: "This certificate has been revoked and can no longer be used."