Lion Cipher Lab
Revoke a certificate: CRL and OCSP
- Identity & Access Management
- Intermediate
- ~45 min
- Free · no account required
Why it matters
Issuing certificates is only half of running a PKI — the other half is being able to kill a certificate that leaked, was mis-issued, or belongs to a decommissioned server, before it expires on its own. Revocation is where real CA operations live, and it is the part most people never actually practice. Doing it by hand once — watching a validation flip from OK to 'revoked' via a CRL, then reading the same verdict live from an OCSP responder — turns 'revocation' from a word in a diagram into something you understand mechanically, including why the industry is quietly walking away from live…
What you'll learn
- certificate revocation
- CRL
- OCSP
- OpenSSL CA
- PKI operations
Steps in this lab
- What revocation is, and why one folder is enough
- Get a shell where OpenSSL actually runs
- Build a tiny CA directory
- Write the openssl.cnf and create the CA
- Issue a server certificate through the CA
- Prove it's valid, then revoke it and regenerate the CRL
- Prove the same thing live with OCSP
- Read the OCSP output and understand what you built