> Taking a certificate back (CRL, OCSP, stapling), Certificate Transparency logs and what famous failures taught. Chapters, guides and fixes in one place. Source: https://pkizerotohero.com/topics/revocation-and-transparency/ Topic # Revocation and transparency When a private key leaks or a certificate is issued by mistake, the CA revokes it. Browsers check revocation in different ways, and much of that checking is soft-fail, which is one reason lifetimes are getting shorter. Certificate Transparency makes publicly trusted TLS certificates visible in public logs, so you can spot certificates for your domains that you never asked for. This hub also covers the incidents that shaped today's rules. ## Understand it: handbook chapters Plain words first, then the real mechanism, what it looks like at work and why it matters. Chapter 16 ### [Taking it back: CRLs, OCSP and stapling](https://pkizerotohero.com/handbook/revocation/) Revocation lets a CA cancel a certificate before it expires, but many clients check late, softly or not at all, so short lifetimes now do much of the work. - IT ops - Expert - Developer Chapter 17 ### [Certificate Transparency](https://pkizerotohero.com/handbook/certificate-transparency/) Certificate Transparency records every publicly trusted TLS certificate in public, append-only logs, so anyone can spot a certificate for their name that they never asked for. - IT ops - Expert - Developer Chapter 18 ### [Famous failures and what changed](https://pkizerotohero.com/handbook/famous-failures/) Real PKI failures, from a hacked CA to expired certificates, follow one pattern: a weak point breaks trust, someone notices, and the rules or practices change. - IT ops - Expert - Leader Appendix ### [Timeline: how PKI got here](https://pkizerotohero.com/handbook/timeline/) From the first public-key papers in the 1970s to ever-shorter certificate lifetimes and post-quantum key exchange: the milestones and incidents that shaped how certificates work today. - Expert - Leader - Teacher ## Do it: how-to guides Step-by-step, with real commands and a way to check it worked. ### [How to monitor Certificate Transparency for your domains](https://pkizerotohero.com/guides/monitor-certificate-transparency/) You will have a scheduled check that lists every new publicly trusted certificate for your domains and flags any certificate issued by a CA you did not allow. - Linux - macOS - Windows ### [How to set CAA records for your domain](https://pkizerotohero.com/guides/caa-records/) You will have DNS CAA records that let only the CAs you really use issue certificates for your names, with separate wildcard rules and an address for violation reports. - Linux - macOS - Windows ## Fix it: error pages The exact messages tools and browsers print, with likely causes and safe fixes. - [Chrome, EdgeNET::ERR\_CERT\_REVOKED](https://pkizerotohero.com/errors/chrome-err-cert-revoked/) ## Check yours: browser tools They run in your browser. Nothing you paste is sent anywhere. Tool ### [Certificate decoder](https://pkizerotohero.com/tools/decoder/) Paste a PEM certificate and read every field in plain words. Tool ### [Chain checker](https://pkizerotohero.com/tools/chain/) Paste a chain and see which link is missing, expired or out of order. ## The big picture: crash course Short lessons of about nine minutes each, with check questions. - [Lesson 8: When trust breaks](https://pkizerotohero.com/course/when-trust-breaks/) ## Look it up: glossary terms Every term in plain words, linked to its full entry. - [Certificate Transparency (CT)](https://pkizerotohero.com/handbook/glossary/#certificate-transparency "A system of public, append-only logs where publicly trusted TLS certificates are recorded, so anyone can spot certificates issued for their domains.") - [CRL (certificate revocation list)](https://pkizerotohero.com/handbook/glossary/#crl "A list, signed by a CA, of the serial numbers of certificates it has revoked before their expiry date.") - [CRLite](https://pkizerotohero.com/handbook/glossary/#crlite "Firefox's compact, privacy-friendly way to check whether any publicly trusted certificate has been revoked, without asking the CA.") - [CT log](https://pkizerotohero.com/handbook/glossary/#ct-log "A public, append-only server that records TLS certificates and returns a signed promise (SCT) that it has logged them.") - [CT monitor](https://pkizerotohero.com/handbook/glossary/#ct-monitor "A service that watches Certificate Transparency logs and alerts you when a certificate is issued for one of your domains.") - [Distrust](https://pkizerotohero.com/handbook/glossary/#distrust "When browsers or operating systems stop trusting a CA, so its certificates are rejected even though they have not expired.") - [Key compromise](https://pkizerotohero.com/handbook/glossary/#key-compromise "When a private key has been, or may have been, exposed to someone who should not have it.") - [Merkle tree](https://pkizerotohero.com/handbook/glossary/#merkle-tree "A tree of hashes in which each node hashes its children, so one root hash commits to every entry below it.") - [OCSP](https://pkizerotohero.com/handbook/glossary/#ocsp "Online Certificate Status Protocol: a way to ask a CA's server whether one specific certificate has been revoked.") - [OCSP stapling](https://pkizerotohero.com/handbook/glossary/#ocsp-stapling "The server fetches a signed OCSP answer about its own certificate and sends it in the handshake, so clients need not ask the CA.") - [Precertificate](https://pkizerotohero.com/handbook/glossary/#precertificate "A copy of a certificate with a poison extension that a CA logs in Certificate Transparency before issuing the real certificate.") - [Revocation](https://pkizerotohero.com/handbook/glossary/#revocation "A CA cancelling a certificate before its expiry date, for example because its private key leaked or it was issued by mistake.") - [SCT (signed certificate timestamp)](https://pkizerotohero.com/handbook/glossary/#sct "A CT log's signed promise to add a certificate to its log, which browsers require before trusting a public TLS certificate.") - [Soft-fail](https://pkizerotohero.com/handbook/glossary/#soft-fail "When a client cannot get a revocation answer, it accepts the certificate anyway instead of failing the connection.") ## Other topics - [Certificates](https://pkizerotohero.com/topics/certificates/) - [Chains and trust stores](https://pkizerotohero.com/topics/chains-and-trust/) - [TLS and HTTPS](https://pkizerotohero.com/topics/tls/) - [Lifecycle and automation](https://pkizerotohero.com/topics/lifecycle-and-automation/) - [Private PKI](https://pkizerotohero.com/topics/private-pki/) - [Hashes and signatures](https://pkizerotohero.com/topics/signing/) - [Post-quantum cryptography](https://pkizerotohero.com/topics/post-quantum/)