Certificate supports CRL revocationWhat it checks and how to fix it

What it checks

Reads the site's TLS certificate and looks for a CRL Distribution Points extension. If one is present it downloads the CRL, verifies it against the issuing certificate and looks for the certificate's serial number: listed means fail, not listed means pass. A certificate without a CRL URL gets a warning.

Why it matters

A certificate that has been revoked (because its key leaked or it was misissued) is still served by servers that were never updated, and some clients accept it. A certificate without a CRL URL cannot be checked for revocation at all by clients that rely on CRLs, now that major CAs are retiring OCSP. If the key is ever compromised, there is no reliable way to tell browsers to stop trusting it before it expires.

How to fix it

Revocation information is written into the certificate by the CA, so the fix is to get a certificate that carries it, and to replace any certificate that shows up as revoked.

If the certificate is revoked, issue a new one with a new private key and deploy it immediately:

# Let's Encrypt with certbot: force a fresh key and certificate
certbot certonly --force-renewal --reuse-key=false -d example.com -d www.example.com
systemctl reload nginx

If the certificate has no CRL URL, check it yourself:

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null \
  | openssl x509 -noout -ext crlDistributionPoints

Then reissue it from a CA that publishes CRLs. Let's Encrypt includes a CRL URL in the certificates it issues; certificates from older or private CAs often do not. On Cloudflare (proxied), the edge certificate is managed for you: use Universal SSL or an Advanced Certificate rather than uploading a custom one without revocation data.