OCSP/CRL Revocation Checker

## What This Tool Extracts Every X.509 certificate can point to the services that report whether it has been revoked. This checker parses a certificate and pulls out those pointers, then helps you query revocation status: - **OCSP responder URL** — from the Authority Information Access (AIA) extension. - **CRL distribution points** — URLs of Certificate Revocation Lists. - **Revocation status** — whether the certificate has been revoked, and why. ## OCSP vs CRL Both answer the same question — "is this certificate still trustworthy?" — by different means: - A **CRL** is a signed list of revoked serial numbers the client downloads and searches. Simple, but lists grow large and may be cached past freshness. - **OCSP** queries a responder for one certificate's status in real time, returning `good`, `revoked`, or `unknown`. Lighter for the client, but adds a live lookup (and a privacy consideration, since the responder learns which sites you visit — OCSP stapling exists to address that). ## Why Revocation Matters A certificate can be valid by date yet untrustworthy — the private key was compromised, the CA mis-issued it, or the domain changed hands. Revocation is how a CA withdraws trust before natural expiry. Checking it is essential when investigating a suspicious certificate or auditing your own PKI. ## When to Use It - Confirming a server certificate has not been revoked after a key-compromise disclosure. - Auditing internal CA hygiene and CRL/OCSP reachability. - Learning how trust withdrawal actually works in TLS. To inspect the rest of the certificate — subject, issuer, SAN, validity, and key usage — pair this with the [X.509 Certificate Decoder](/tools/security/x509-decoder).