OCSP/CRL Revocation Checker

What This Tool Extracts

Every X.509 certificate can point to the services that report whether it has been revoked. This checker parses a certificate and pulls out those pointers, then helps you query revocation status:

• OCSP responder URL — from the Authority Information Access (AIA) extension.
• CRL distribution points — URLs of Certificate Revocation Lists.
• Revocation status — whether the certificate has been revoked, and why.

OCSP vs CRL

Both answer the same question — "is this certificate still trustworthy?" — by different means:

• A CRL is a signed list of revoked serial numbers the client downloads and searches. Simple, but lists grow large and may be cached past freshness.
• OCSP queries a responder for one certificate's status in real time, returning good, revoked, or unknown. Lighter for the client, but adds a live lookup (and a privacy consideration, since the responder learns which sites you visit — OCSP stapling exists to address that).

Why Revocation Matters

A certificate can be valid by date yet untrustworthy — the private key was compromised, the CA mis-issued it, or the domain changed hands. Revocation is how a CA withdraws trust before natural expiry. Checking it is essential when investigating a suspicious certificate or auditing your own PKI.

When to Use It

• Confirming a server certificate has not been revoked after a key-compromise disclosure.
• Auditing internal CA hygiene and CRL/OCSP reachability.
• Learning how trust withdrawal actually works in TLS.

To inspect the rest of the certificate — subject, issuer, SAN, validity, and key usage — pair this with the X.509 Certificate Decoder.