<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-certificate-revocation-monitoring
description: >-
  Monitor certificate revocation status through OCSP, CRL, and Certificate
  Transparency logs. Covers OCSP stapling verification, CRL distribution
  point monitoring, CT log anomaly detection, and automated revocation
  alerting for incident response and compliance.
domain: cybersecurity
subdomain: cryptography
tags:
  - ocsp
  - crl
  - certificate-transparency
  - revocation
  - ocsp-stapling
  - ct-logs
  - pki-monitoring
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1553.004"]
---

# Performing Certificate Revocation Monitoring

## Overview

Certificate revocation monitoring ensures compromised or misissued certificates
are detected and acted upon promptly. Revocation failures allow attackers to
use stolen certificates. This skill covers OCSP status checking, CRL parsing,
OCSP stapling verification, and Certificate Transparency log monitoring.

## Prerequisites

| Requirement | Install |
|---|---|
| OpenSSL 3.x | `apt install openssl` |
| curl | HTTP requests for OCSP/CRL/CT |
| Python 3.10+ | For agent tooling |
| jq | `apt install jq` |

## Key Concepts

### OCSP Status Checking

```bash
# Extract OCSP responder URL
openssl x509 -in cert.pem -noout -ocsp_uri

# Full OCSP check workflow
openssl s_client -connect example.com:443 < /dev/null 2>/dev/null | \
  openssl x509 -out leaf.pem
openssl s_client -connect example.com:443 -showcerts < /dev/null 2>/dev/null | \
  awk '/BEGIN/{n++} n==2{print}' > issuer.pem

OCSP_URL=$(openssl x509 -in leaf.pem -noout -ocsp_uri)
openssl ocsp -issuer issuer.pem -cert leaf.pem \
  -url "$OCSP_URL" -resp_text -noverify
```

### OCSP Stapling Verification

```bash
# Check for stapled OCSP response
openssl s_client -connect example.com:443 -status < /dev/null 2>&1 | \
  grep -A20 "OCSP Response"

# Verify staple presence
openssl s_client -connect example.com:443 -status < /dev/null 2>&1 | \
  grep "OCSP Response Status"
```

### CRL Monitoring

```bash
# Extract CRL distribution point
openssl x509 -in cert.pem -noout -text | grep -A2 "CRL Distribution"

# Download and inspect CRL
curl -sO http://crl.example.com/intermediate.crl
openssl crl -in intermediate.crl -inform DER -text -noout

# Check CRL freshness
openssl crl -in intermediate.crl -inform DER -noout -lastupdate -nextupdate
```

### CT Log Monitoring

```bash
# Query crt.sh for domain certificates
curl -s "https://crt.sh/?q=%.example.com&output=json" | \
  jq '.[0:10] | .[] | {issuer_name, common_name, not_after}'

# Check for unexpected issuers
curl -s "https://crt.sh/?q=example.com&output=json" | \
  jq '[.[] | .issuer_name] | group_by(.) | map({issuer: .[0], count: length})'
```

## Common Failures

| Failure | Cause | Fix |
|---|---|---|
| OCSP timeout | CA responder overloaded | Enable OCSP stapling |
| Stale staple | Server not refreshing | Configure regular refresh |
| CRL too large | Many revoked certs | Use OCSP for real-time |
| CT blind spots | Private CA not logged | Monitor internal CA separately |

## Workflow

1. **Configure** — Set up OCSP/CRL monitoring endpoints
2. **Monitor** — Continuous status and freshness checking
3. **Alert** — Notify on revocation events or failures
4. **Investigate** — Determine revocation reason and impact
5. **Respond** — Replace revoked certificates
6. **Audit** — Review CT logs for unauthorized issuance

## Verification

| Check | Method |
|---|---|
| OCSP reachable | Valid responses for all certs |
| OCSP stapling active | Server provides stapled response |
| CRL current | `nextUpdate` in the future |
| No revoked certs in use | All active certs show `good` status |

## References

- [RFC 6960 — OCSP](https://datatracker.ietf.org/doc/html/rfc6960)
- [RFC 5280 — X.509 CRL Profile](https://datatracker.ietf.org/doc/html/rfc5280)
- [RFC 6962 — Certificate Transparency](https://datatracker.ietf.org/doc/html/rfc6962)
- [crt.sh — CT Log Search](https://crt.sh/)
