Certificate revocation, OCSP, and incident response

Expiration is a planned end to a certificate’s validity. Revocation is an earlier status change used when a certificate should no longer be trusted, for example after a private-key compromise, incorrect issuance, or a material change in certificate details.

What OCSP does—and does not do

Online Certificate Status Protocol (OCSP) can provide status information for certificates when the certificate authority and client support the relevant mechanism. OCSP stapling lets a server present a signed status response during the TLS connection. A missing stapled response is not automatically proof that a certificate is revoked; policy and client behavior determine its significance.

Important: revocation response, browser behavior, and certificate-authority procedures vary. Follow the issuing authority’s current incident instructions and do not treat one endpoint observation as a complete revocation audit.

If a private key may be exposed

  1. Contain the affected service and preserve incident evidence.
  2. Contact the certificate authority and request revocation or replacement as appropriate.
  3. Generate a new key through the approved secrets process; do not reuse a potentially exposed key.
  4. Replace the certificate on every serving path and remove the old material.
  5. Check logs, inventories, backups, and dependent systems for other deployments.
  6. Verify the public endpoint and document the incident owner and follow-up.

What the inspector reports

The scanner can report the OCSP-related evidence visible in the tested connection and the certificate validity window. It cannot determine whether a private key was copied, whether every client refreshed status, or whether an organization completed its incident response. Treat a warning as a prompt to investigate—not as a stand-alone compliance verdict.

Last reviewed: October 2026. Confirm current CA/Browser Forum, certificate-authority, and client guidance before making a high-impact change.