Certificate Revocation: Expiry and Historical Validation

What is certificate revocation?

Certificate revocation records that a certificate should no longer be relied on under the issuer’s rules, for example after key compromise or a change in eligibility. It differs from expiration, the end of the certificate’s stated validity period.

Renewal produces a new certificate or renewed credential under the issuer’s process. It does not rewrite an old signature or automatically make a revoked certificate trustworthy again.

CRL versus OCSP

A certificate revocation list (CRL) is an issuer-signed list of revoked certificates. The Online Certificate Status Protocol (OCSP) provides a signed status response for a queried certificate. RFC 6960 defines responses including good, revoked and unknown.

“Good” is not a blanket assertion of identity, legal validity or even every aspect of certificate issuance. The responder’s authority, response freshness and other certificate checks still matter. “Unknown” does not, by itself, mean the certificate has been revoked.

Does expiry invalidate every earlier signature?

Not automatically. A signature assessed at a relevant past time can require reliable evidence of when it existed, the certificate’s status at that time and the applicable validation policy. A document’s displayed signing date alone does not establish a trusted historical time.

The European Commission’s DSS validation documentation distinguishes current and past validation with supporting proofs of existence. Revocation timing, its reason and available evidence can affect the conclusion; neither “expired now means always invalid” nor “a timestamp makes it valid forever” is a reliable rule.

What should a relying party preserve?

Keep the original signature and necessary certificate, status and time evidence for later validation. Consider the signing certificate and its trust path together. A fresh certificate or screenshot cannot replace missing evidence about the original signature.