Check a TLS certificate's revocation status through OCSP, the CRL and the stapled response the server sends.
Enter a domain to check its certificate revocation status
OCSP (Online Certificate Status Protocol) allows browsers and clients to check in real time whether a TLS certificate has been revoked before its expiry date. Revocation happens when a certificate is compromised, mis-issued, or the domain owner requests it. This tool has VLANlab's server connect to the domain and read the certificate it presents, then asks the issuing CA: through its Certificate Revocation List (CRL), and through its OCSP responder when the certificate names one in its Authority Information Access (AIA) extension. Many certificates, including all from Let's Encrypt, no longer name an OCSP responder, so the CRL is often the only answer. When the web server staples an OCSP response to the connection (OCSP stapling, which saves clients a round-trip), the tool shows that response too.