Certificate Validity and Revocation: CRLs and OCSP

Lesson plan

Level

Beginner

Time

About 50 minutes; the steps below add up to 50

Learners decide what should happen to a lost bank card with two years left, and why cards expire at all, before validity and revocation are named. Predictions then precede reasons to revoke, whether revocation works at once, yesterday’s list, asking about one certificate, what still works when the service is down and whether to block or carry on; checks follow expiry, OCSP privacy and the industry’s response. The habit to build: a revocation counts only if the checker hears about it.

Objectives

• Explain validity periods and why certificates expire
• Explain revocation and why it matters only if clients find out
• Compare CRLs and OCSP, including stapling
• Explain the limits of revocation checking and the industry’s response
• Respond correctly to a stolen private key

Before the lesson

• Open this page on your own screen and use “Open the lesson window” to open the lesson in a second window. Share only that second window.
• Learners need the PKI and Certificates lesson first.
• The bank-card comparison carries through: a list of cancelled cards, or a call to the bank.
• The lesson takes about 50 minutes.
• In presentation mode every step is shown in turns: Next reveals one moment, part or answer at a time, and the instructor view names what is on screen and what comes next.

Steps

1. Introduction Opening

   On screen: the lesson’s title, module and number; Next adds its objectives and key terms, as the lesson page lists them; Next again begins the first step.

   Objectives on screen

   • Explain validity periods and why certificates expire
   • Explain revocation and why it matters only if clients find out
   • Compare CRLs and OCSP, including stapling
   • Explain the limits of revocation checking and the industry’s response
   • Respond correctly to a stolen private key

   Purpose: Learners decide what should happen to a lost bank card with two years left, and why cards expire at all, before validity and revocation are named. Predictions then precede reasons to revoke, whether revocation works at once, yesterday’s list, asking about one certificate, what still works when the service is down and whether to block or carry on; checks follow expiry, OCSP privacy and the industry’s response. The habit to build: a revocation counts only if the checker hears about it.

2. 1. A lost bank card Think 5 min

   Purpose: Raise early withdrawal and its two mechanisms through a lost card.

   Ask

   • What do you want to happen?
   • Why do cards expire?

   Responses to expect

   • “Cancel it” comes at once; how machines learn needs a prompt.
   • On screen in turns: the opening question, its answer; then the question on why things expire, and its answer.

   Discussion pause: Ask how a card machine in another country would know.

   In the lesson window

   • Think it through: You lose your bank card. Its expiry date is two years away. What do you want to happen, and how would a shop’s card machine find out?
   • Think it through: Why might a card, or a certificate, be given an expiry date at all?

3. 2. Validity and expiry Explain 5 min

   Purpose: Explain validity dates and the reasons for expiry.

   Ask

   • Does checking expiry need the network?

   Responses to expect

   • Some think it does.
   • On screen in turns: the opening; then why expiry exists, starting with limiting damage; keeping information current; retiring old technology; expiry is checked by the client; the check question on whether expiry needs a network, and its answer; expired certificates and availability; how long a public certificate may last.

   In the lesson window

   • Check your understanding: Does checking whether a certificate has expired need a network connection?

4. 3. Revocation: ending a certificate early Predict 5 min

   Purpose: Explain revocation, its reasons, and that clients must find out.

   Ask

   • Why revoke?
   • Does everyone stop trusting it at once?

   Responses to expect

   • Instant effect is the default assumption.
   • On screen in turns: the opening; then the question on reasons to revoke, and its answer; typical reasons, starting with a compromised key; issued in error; details no longer true; no longer needed; the CA itself compromised; the question on whether everyone stops trusting it, and its answer; revocation matters only when software learns of it.

   Misconceptions to challenge

   • A learner may believe: “Revoking a certificate stops it working everywhere at once.” Respond: Only clients that find out stop trusting it.

   In the lesson window

   • Think it through: List reasons a certificate might need to be withdrawn before its expiry date.
   • Think it through: The CA revokes a certificate. Does every browser stop trusting it at once?

5. 4. Certificate revocation lists Predict 5 min

   Purpose: Describe CRLs, their strengths and their freshness problem.

   Ask

   • What does yesterday’s list miss?

   Responses to expect

   • This morning’s revocation.
   • On screen in turns: the opening; then checking against the list; the question on a certificate revoked this morning, and its answer; the CRL’s strength and weaknesses; its weaknesses; checking with a CRL, starting with the request; the signed list.

   In the lesson window

   • Think it through: A certificate is revoked this morning. A browser checks yesterday’s list. What happens?

6. 5. Online Certificate Status Protocol Predict 7 min

   Purpose: Describe OCSP, its privacy cost and stapling.

   Ask

   • What else could the browser do?
   • What does OCSP reveal?

   Responses to expect

   • Privacy is rarely considered.
   • On screen in turns: the opening question, its answer; then OCSP; OCSP’s strength and weaknesses; its weaknesses; checking with OCSP, starting with the question; the signed answer; when the question gets no answer; the check question on what OCSP reveals, and its answer; OCSP stapling.

   To go further

   • How does stapling remove the privacy problem, and why has it not been required widely?

   In the lesson window

   • Think it through: Instead of downloading a whole list, what else could a browser do to find out whether one certificate is revoked? What would that reveal?
   • Check your understanding: What does plain OCSP reveal to the CA?

7. 6. CRL and OCSP compared Predict 4 min

   Purpose: Compare the two methods.

   Ask

   • Which still works when the service is down?

   Responses to expect

   • A cached CRL.
   • On screen in turns: the opening question, its answer; then CRL and OCSP, side by side; CRL and OCSP compared, with OCSP held back; the OCSP column.

   Discussion pause: The OCSP column is held back: for each row, ask how OCSP differs from a CRL before revealing it.

   In the lesson window

   • Think it through: If the CA’s service cannot be reached, which method still gives the browser something to go on?

8. 7. The limits of revocation checking Predict 9 min

   Purpose: Explain soft-fail and the other limits, the industry’s response, and the stolen-key example.

   Ask

   • Block or carry on?
   • What has the industry done?

   Responses to expect

   • Learners are surprised that most clients carry on.
   • Reveal the four weaknesses one at a time, then the three responses; ask which weakness each response answers.
   • On screen in turns: the opening question, its answer; then the weakest part of PKI, starting with soft-fail; freshness; privacy; coverage; the industry’s three responses, starting with browser-distributed lists; a move back towards CRLs; shorter lifetimes; revocation reduces risk; it does not remove it; the check question on the industry’s response, and its answer; a stolen private key, starting with a new key pair; a new certificate; revoking the old one; investigating; what doing nothing would leave.

   Misconceptions to challenge

   • A learner may believe: “Revocation removes the risk from a stolen key.” Respond: It reduces it; the cause must be found too.

   If the explanation does not land: A shop whose card checker is down: refuse every customer, or take the risk?

   In the lesson window

   • Think it through: A browser cannot reach the revocation service. Should it block the site or carry on? What does an attacker gain from each choice?
   • Check your understanding: Which of these has the industry done to reduce its reliance on revocation?

9. 8. Security+ terminology Explain 1 min

   Purpose: Link the lesson to the Security+ wording.

   Ask

   • Which two terms are listed?

   Responses to expect

   • CRLs and OCSP.
   • On screen in turns: the opening; then what the objectives do not list.

10. 9. Apply it in a new situation Apply 4 min

    Purpose: Set up independent application, ideally on a later day.

    Ask

    • Who will try these now, and who later in the week?

    Responses to expect

    • The copied key tests the response; the error tests expiry; the manager tests investigation.
    • On screen in turns: the opening; then the question on a copied key, and its answer; the question on a sudden security error, and its answer; the question on whether revocation solved it, and its answer.

    In the lesson window

    • Apply it: A web server’s private key has been copied by an intruder. Which first step makes sense?
    • Apply it: The company website suddenly shows a security error to every visitor. Nothing was attacked. What is the most likely cause?
    • Apply it: After revoking a stolen certificate, a manager says the problem is solved. What else is needed?

11. 10. Check your understanding Check 3 min

    Purpose: Check the lesson against the approved revision-bank questions.

    Ask

    • Answer individually, then compare before revealing.

    Responses to expect

    • The CRL and OCSP questions link to the comparison.
    • On screen in turns: the opening; then the revision questions one at a time, each followed by its answer; where to practise next.

12. 11. What to remember Consolidate 2 min

    Purpose: Summarise the five points, the key terms and the misunderstandings.

    Ask

    • Without looking: one strength and one weakness of OCSP.

    Responses to expect

    • Current and small; reveals which site.
    • On screen in turns: the opening; then the summary; the key terms; the common misunderstandings.

13. Lesson recap Closing

    On screen: the lesson’s objectives again; Next adds the closing question, which asks the class to explain each one in their own words without looking back. It says nothing about what anyone has learnt: use the answers to decide what to revisit.

    Points to listen for

    • End dates limit damage.
    • Revocation counts only when heard.
    • A list, or a question.
    • Checks often fail open.
    • New key, new certificate, revoke, investigate.

Consolidation

• End dates limit damage.
• Revocation counts only when heard.
• A list, or a question.
• Checks often fail open.
• New key, new certificate, revoke, investigate.