RevocationListen

RevocationListen is a concept within public key infrastructure (PKI) describing a real-time or near-real-time mechanism for disseminating certificate revocation information to relying parties. It is intended to complement traditional revocation methods such as certificates revocation lists (CRLs) and the Online Certificate Status Protocol (OCSP) by providing push-based updates rather than periodic or on-demand queries. While not a universally standardized protocol, several deployments explore RevocationListen as a means to reduce revocation latency and improve trust decisions in environments with high security requirements.

The core components of a RevocationListen ecosystem typically include a revocation authority (such as a certificate issuer or certificate management service), a dedicated RevocationListen service that broadcasts signed revocation events, and clients or relying parties that subscribe to the feed. Revocation events usually contain fields such as certificate issuer, serial number, revocation timestamp, revocation reason, and a digital signature from the issuing authority. The events may be delivered through streaming HTTP endpoints, WebSocket channels, or long-polling interfaces, and client applications validate signatures and maintain an up-to-date local revocation cache.

Operationally, when a certificate is revoked, the issuing authority generates a signed event and publishes it to the RevocationListen feed. Subscribed clients receive the event, verify its authenticity, and update their local revocation lists or caches accordingly. Some implementations may support batching, event versioning, or gap-filling mechanisms to handle missed messages and ensure resilience.

Security considerations emphasize strong authentication, integrity, and tamper-evidence of events, along with resilience to service outages. Adoption varies, and RevocationListen is typically viewed as a supplementary layer that must interoperate with existing PKI infrastructure and policies. See also: CRLs, OCSP, OCSP stapling, PKI.