How does certificate revocation work in a PKI?

When a certificate must be invalidated before its natural expiry date, for example because its private key has been compromised or the certificate holder no longer requires access, the issuing CA needs a way to communicate that the certificate should no longer be trusted, even though it has not yet expired.

The two primary revocation mechanisms:

• Certificate Revocation Lists (CRLs): Periodically published lists of revoked certificate serial numbers that relying parties download and check.
• Online Certificate Status Protocol (OCSP): A real-time query mechanism that lets a relying party check a single certificate's status without downloading an entire list.
• Emergency revocation: Immediate revocation processes for time-critical situations such as confirmed key compromise.

Relying parties are expected to check revocation status before trusting a certificate, which ensures that compromised or no-longer-authorized certificates are rejected promptly rather than remaining trusted until their original expiry date arrives.