tls.cert.revocation_unavailable
Revocation Status Unavailable
What we check
We attempt to contact the certificate authority's revocation endpoints — the OCSP responder and/or CRL distribution point named in the certificate. This finding fires when the endpoint exists but did not return a usable response.
What this finding means
We tried to check whether the certificate has been revoked, but the authority's endpoint was unreachable, timed out, or returned an unparseable response. The revocation status is genuinely indeterminate — this is neither a pass nor a revocation.
Why it matters
- Uncertainty, not failure. The certificate may be perfectly valid — we simply could not confirm it. This is an operational issue at the CA's endpoint, not a problem with the mail server's configuration.
- Informational only. Mail delivery is not affected by this finding. Sending servers using opportunistic TLS do not typically check revocation, and even strict implementations treat an unreachable OCSP responder as a soft failure.
How it's graded
An unavailable revocation status is informational and carries no penalty. See Grading Methodology for the full scoring model.
Evidence example
Certificate serial: 05:C3:D4:E5:F6:A7:B8
OCSP responder: http://ocsp.example-ca.com
Status: error — connection timed out after 10s
CRL: not checked (certificate names no CRL distribution point)