Certificate Revocation in the TLS Ecosystem: A Survey

In the PKI system, revoking problematic certificates in a timely manner is essential for secure communications on the Internet. Regrettably, the primary revocation schemes have shown limitations in various aspects such as privacy and scalability. Although many state-of-the-art revocation techniques have been proposed to overcome such limitations, the implications of their deployment in practice in each aspect have not been deeply studied. This article aims to systematically classify and comparatively analyze the existing schemes in terms of security, efficiency, and practicality. Based on our evaluation, we also provide insight into securing the revocation systems, and finally discuss their future directions.