tls.cert.revocation_not_published
No Revocation Endpoint Published
What we check
We look for revocation endpoints in the certificate's extensions: an OCSP responder URL in the Authority Information Access (AIA) extension, and CRL distribution points. This finding fires when the certificate names no endpoint for the revocation methods we checked.
What this finding means
The certificate does not publish any revocation endpoint that our checks can use. This is increasingly common and not a defect — Let's Encrypt retired its OCSP responders in 2025 and switched to CRL-only revocation. Certificates from CAs that publish only CRLs (or only OCSP) will show this finding when the other method is absent.
Why it matters
- Not actionable. The mail server operator cannot add revocation endpoints to a certificate — that is the CA's decision when issuing it.
- Informational transparency. This finding is reported rather than suppressed so that administrators see why no revocation result appears, rather than wondering whether the check was skipped.
How it's graded
No revocation endpoint is informational and carries no penalty. See Grading Methodology for the full scoring model.
Evidence example
Certificate issuer: R11 (Let's Encrypt)
Authority Information Access: OCSP — none (retired 2025)
CRL Distribution Points: http://r11.c.lencr.org/
Checked methods: OCSP only → no endpoint to query