tls.cert.revocation_unknown

Revocation Status Unknown

What we check

We query the certificate authority's revocation endpoints — the OCSP responder and/or CRL distribution point — and evaluate the response. This finding fires when the authority responds but explicitly states it does not know the certificate.

What this finding means

The certificate authority answered the revocation query but reported that it does not recognize this certificate — the serial number is not in its records. This can happen when:

• The OCSP responder serves a different CA hierarchy than the one that issued the certificate.
• The certificate was issued by an intermediate CA whose responder was decommissioned.
• The OCSP request was malformed (wrong issuer hash).

Why it matters

• Indeterminate, not revoked. An "unknown" response is not evidence of revocation — it means the authority cannot vouch for the certificate either way.
• Informational only. This finding does not affect mail delivery or the server's grade. It is reported for transparency so administrators know the revocation check was inconclusive.

How it's graded

An unknown revocation status is informational and carries no penalty. See Grading Methodology for the full scoring model.

Evidence example

Certificate serial: 06:D4:E5:F6:A7:B8:C9
OCSP responder: http://ocsp.example-ca.com
OCSP status: unknown — responder does not recognize this certificate

References

• RFC 6960 — X.509 Internet Public Key Infrastructure Online Certificate Status Protocol - OCSP
• RFC 5280 — Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile