Certificate Revocation

Objective:

EnsureMake sure your system correctlychecks performswhether thea certificate validityis check.still valid and has not been revoked.

Guidelines: 

• The deployedYour system shouldmust becheck ablethat to checks thea certificate validity i.e. to check if the certificate ishas not revoked.been Tworevoked protocolsbefore areaccepting used:it. Use one or both of these standard protocols:
  • OCSPOSCP (Online Certificate Status Protocol) and— /orchecks the status of a single certificate in real time.
  • CRL (Certificate Revocation List).—a published list of revoked certificates.
• EnsureIf thata revokedcertificate certificateshas arebeen rejectedrevoked, byyour thesystem system,must reject it and logrecord the event in a log for auditingauditing.
purposes.
The
• Show the user should get a properclear, communicationeasy-to-understand message in casewhen a revoked certificate is usedused—for example: "This certificate has been revoked and can no longer be used."