Revocation checking is the process of verifying whether a digital certificate has been withdrawn before its normal expiration date. Certificates can be revoked when a private key is compromised, a certificate is misissued, or the identity behind it is no longer trusted. In TLS and other PKI-based systems, revocation checking helps a client avoid accepting a certificate that is technically valid by date but no longer safe to use.
This control matters because encryption alone does not prove trust. If revocation checks are skipped, fail open, or rely on stale cache data, an attacker may present a revoked certificate and still be accepted as a legitimate peer. Defenders use mechanisms such as certificate revocation lists and online status checks to reject bad credentials during handshakes. In practice, revocation logic is a common weak point in libraries and applications because it must work correctly across different protocols, settings, and network conditions.