PKI Fundamentals
CRL vs OCSP: How Certificate Revocation Actually Works (and Where It Still Fails)
A certificate is a signed statement that a key belongs to an identity. Revocation is how a CA says 'actually, never mind'. Twenty-five years into the X.509 era we still have two mechanisms for revocation - CRLs and OCSP - plus a dozen variations and workarounds. This is the field guide: what each one does, where each one breaks, and the specific configuration you want in 2026.
2026-10-2814 min read