Advanced › Module 6 › Lesson 3
OCSP CRL
Revocation literacy — OCSP stapling, CRL distribution points, soft-fail risks — read responses on example.com, not prod bypass.
Visual · t28_ocsp_crl
OCSP/CRL = named revocation checks. $CRYPTO_LAB literacy. Original Cyberlium.
Opening
A valid-looking cert can still be revoked — name OCSP and CRL before you call any chain trustworthy.
Revocation literacy names OCSP (Online Certificate Status Protocol), CRL (Certificate Revocation List), OCSP stapling in TLS handshake, CRL Distribution Points extension, soft-fail vs hard-fail client behavior, and short-lived cert alternative. Analyst reads openssl s_client -status on example.com or $CRYPTO_LAB revoked cert sample — documents good/revoked/unknown — without disabling revocation checks on production to 'test exploits.' Cyberlium teaches named checks and defender hygiene (stapling, monitor expiry, automate renewal) — NOT OCSP responder DoS on stranger infrastructure, NOT CRL replay attacks on prod. Lab row: OCSP vs CRL comparison table with latency, freshness, and stapling note.
1. OCSP vs CRL
OCSP: real-time status query; CRL: published list — trade latency vs offline verification.
Stapling attaches OCSP response in TLS — reduces client round trips and privacy leaks.
Command guide
Try these commands — OCSP vs CRL
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
X.509 literacy — https://www.rfc-editor.org/rfc/rfc5280 (certificate structure) RFC 8446 — https://www.rfc-editor.org/rfc/rfc8446 (TLS 1.3 cert chain) NIST PKI — https://csrc.nist.gov/projects/cryptographic-standards-and-guidelines
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export CRYPTO_LAB=${CRYPTO_LAB:-$HOME/cyberlium-lab/t28-crypto}
cat > "$CRYPTO_LAB/notes/x509-lab-cert-anatomy.txt" <<'EOF'
YOUR lab-selfsigned.crt fields:
Subject: CN=cyberlium-lab.local (self-signed — not publicly trusted)
Public key: RSA 2048 from lab-toy-2048.pem
Validity: 365 days from creation
Signature: signed by same key (self-signed)
production: CA-signed chain + CT log entry — curl crt.sh for literacy
EOFCommand — copy this
openssl x509 -in "$CRYPTO_LAB/certs/lab-selfsigned.crt" -noout -text | grep -E 'Subject:|Public-Key:|Signature Algorithm:' grep -E 'Subject|self-signed|CT' "$CRYPTO_LAB/notes/x509-lab-cert-anatomy.txt"
Primary tools to practice this lesson: grep, python3. Reference sites: X.509 literacy (https://www.rfc-editor.org/rfc/rfc5280); RFC 8446 (https://www.rfc-editor.org/rfc/rfc8446); NIST PKI (https://csrc.nist.gov/projects/cryptographic-standards-and-guidelines). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Defender hygiene
Enable stapling on servers you admin; monitor revocation events for owned certs.
Short-lived certs reduce CRL/OCSP dependency — note in modern hygiene reviews.
3. Refused
No OCSP responder DoS on unauthorized infrastructure; no disabling revocation in prod clients.
Revocation literacy supports trust decisions — not exploit facilitation.
4. What you ship: OCSP/CRL comparison table
OCSP vs CRL rows + stapling note + NEVER disable revocation line.
5. What you record before the next lesson
OCSP/CRL comparison table path.
6. Wrong vs right: prod crypto oracles vs CTF toys
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Disable OCSP checking on employer laptop to 'practice PKI.'
Right
OCSP/CRL comparison from example.com or $CRYPTO_LAB read. Next: PKI Lab.
Mission: OCSP/CRL comparison table
1) Define OCSP and CRL. 2) Write stapling benefit in one line. 3) One soft-fail risk note. 4) Write NEVER disable revocation line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Short-lived certs — revocation tradeoff?”
Knowledge Check
APPLY: OCSP stapling:
Multiple choice
Knowledge Check
APPLY: True or False: Disabling revocation checks on prod is lab.
True or False
Knowledge Check
APPLY: CRL is:
Multiple choice