Certificate Revocation Lab
Revocation fails on the details, not the concept. A certificate can be cleanly revoked, cleanly valid — or sit in the large grey middle: an OCSP “good” that is stale or signed by an untrusted responder, a CRL from the wrong issuer, a stale list that still lists a revoked serial, a responder that simply does not answer. For each case, read the OCSP response and the CRL, then call the verdict and the client action — and let the fail policy and the revocation reason decide between block and soft-fail.
The real job. More noise, a tighter clock.
Call the revocation status
You are the validation logic inside a client. For each certificate you are handed whatever revocation evidence could be gathered — an OCSP response, a CRL, or neither — as already-decoded objects. Decide the verdict (valid / revoked / unknown) and the client action (proceed / block / soft-fail). Watch the dates, the signer, and the revocation reason. Score up to 2 points per scenario: 1 for the verdict, 1 for the action. Clear 75% to pass — finish under par for a speed bonus and a better grade.
What this lab is
- A free, browser-based lab on certificate revocation: for each case you are handed a certificate plus its revocation evidence (an OCSP response and/or a CRL, as decoded objects) and must call the verdict and the client action.
- The verdict is valid / revoked / unknown; the action is proceed / block / soft-fail (proceed with risk). They are graded separately because they are separate decisions.
- Edge cases are the whole point: an OCSP "good" that is stale or signed by an untrusted responder, a CRL from the wrong issuer, a stale CRL that still lists a revoked serial, and a responder outage under soft-fail vs hard-fail policy.
- The revocation reason matters: keyCompromise is always a hard block, while an administrative reason like cessationOfOperation can leave an earlier-timestamped code signature usable.
- 100% client-side — no OCSP/CRL is actually fetched, no account, no install. Every object is bundled static data you reason over, exactly as a client would after parsing a real response.
Frequently asked questions
What is the Certificate Revocation Lab?
A free, in-browser exercise where you play the validation logic inside a TLS or code-signing client. For each certificate you are shown the revocation evidence that was gathered — an OCSP response, a CRL, or neither — as already-decoded objects, and you decide the revocation verdict (valid, revoked, or unknown) and the correct client action (proceed, block, or soft-fail). You are scored on both, with a debrief explaining each call.
What is the difference between OCSP and a CRL?
A CRL (Certificate Revocation List) is a signed list, published periodically by a CA, of the serial numbers it has revoked; a client downloads it and checks whether the serial is on it. OCSP (Online Certificate Status Protocol) asks a responder about one specific certificate and gets back good, revoked, or unknown. Both can go stale (past their nextUpdate), both must be signed by the right authority, and both are only trustworthy when they actually apply to the certificate in hand.
Why can a certificate be "unknown" rather than valid or revoked?
Unknown means no source you can trust gives a current answer. An OCSP responder can literally return "unknown" (it has no record of the serial); a response can be stale or signed by an unauthorised responder; a CRL can be expired or issued by the wrong CA; or every source can simply be unreachable. In all of these the honest verdict is "unknown" — and what you then do depends on the client's fail policy.
What is soft-fail vs hard-fail?
It is the client's policy for what to do when revocation status cannot be confirmed. Hard-fail refuses the certificate (secure but brittle — an outage at the responder breaks the service). Soft-fail proceeds but flags the risk (resilient but bypassable — an attacker who can block the revocation check gets treated as "unknown" and waved through). Most browsers soft-fail. The lab makes you apply the policy, because the same "unknown" verdict maps to block under hard-fail and to proceed-with-risk under soft-fail.
Is this a real certificate validator?
No. It is a teaching model of the revocation decision. It deliberately ignores path building, name constraints, key usage and the full ASN.1 so the one lesson — verdict and action from OCSP/CRL evidence, with the dates, the signer and the reason — is clear. Every certificate, responder, CRL and serial is invented.