How to check if a letsencrypt certificate has been revoked

Question

I am trying to check if a certificate issued by letsencrypt has been revoked based on this answer:

 openssl ocsp -issuer highschoolhelper.org_fullchain.crt  -cert highschoolhelper.org_fullchain.crt  \
      -text -url http://ocsp.int-x3.letsencrypt.org  -header "HOST" "ocsp.int-x3.letsencrypt.org"

highschoolhelper.org_fullchain.crt content:

But I am getting this output instead:

OCSP Request Data:
    Version: 1 (0x0)
    Requestor List:
        Certificate ID:
          Hash Algorithm: sha1
          Issuer Name Hash: 7EE66AE7729AB3FCF8A220646C16A12D6071085D
          Issuer Key Hash: 631192891A849CF47501DE858F83FF62B943199A
          Serial Number: 0486E5A1D0B9C6D97280AC24D47C6B552370
    Request Extensions:
        OCSP Nonce:
            0410193D65F8B1D045055EE5862101F61D02
Responder Error: unauthorized (6)

@SteffenUllrich I corrected my question, it seems I was copying the wrong file name. — H Aßdøµ, May 24 '20 at 21:28

score 2 · Accepted Answer · answered May 24 '20 at 21:52

Your input file contains two certificates: the leaf certificate first and the chain certificate second. The chain certificate is the issuer of the leaf certificate so it needs to be used for the -issuer argument if the leaf certificate is to be checked (-cert argument).

Only, you provide the same file both for issuer and cert. In both cases it will take the first certificate out of the file which means it will take the same certificate for issuer and cert - which is wrong. To fix this split your file into two: put the first certificate into cert.pem and the second into issuer.pem and then try again:

$ openssl ocsp -issuer issuer.pem -cert cert.pem \
    -text -url http://ocsp.int-x3.letsencrypt.org  -header "HOST" "ocsp.int-x3.letsencrypt.org"

...
OCSP Response Data:
    ...
    Responder Id: C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
    ...
    Cert Status: good
    This Update: May 24 03:00:00 2020 GMT
    Next Update: May 31 03:00:00 2020 GMT

That is explains why the server was returning an error. – H Aßdøµ May 25 '20 at 13:57 — H Aßdøµ, May 25 '20 at 13:57

score 1 · Answer 2 · answered May 25 '20 at 21:22

Besides Steffen's answer using OCSP you can also use Certificate Transparency Logs search interfaces, that store all certificates, and their revocation status, from any public CA.

If you search with https://crt.sh/?q=highschoolhelper.org you get 7 certificates:

crt.sh ID    Logged At  ⇧   Not Before  Not After   Matching Identities     Issuer Name
2848441767  2020-05-24  2020-05-24  2020-08-22  highschoolhelper.org
                                                www.highschoolhelper.org    C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3
2850401771  2020-05-24  2020-05-24  2020-08-22  highschoolhelper.org    C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3
2849897415  2020-05-23  2020-05-23  2020-08-21  highschoolhelper.org    C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3
2845143222  2020-05-23  2020-05-23  2020-08-21  highschoolhelper.org    C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3
2844662744  2020-05-23  2020-05-23  2020-08-21  highschoolhelper.org    C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3
2753256176  2020-05-02  2020-05-02  2020-07-31  highschoolhelper.org
                                                mail.highschoolhelper.org
                                                www.highschoolhelper.org    C=US, ST=TX, L=Houston, O="cPanel, Inc.", CN="cPanel, Inc. Certification Authority"
2753256196  2020-05-02  2020-05-02  2020-07-31  highschoolhelper.org
                                                mail.highschoolhelper.org
                                                www.highschoolhelper.org    C=US, ST=TX, L=Houston, O="cPanel, Inc.", CN="cPanel, Inc. Certification Authority"

The first certificate in your dump has:

        Issuer: C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3
        Validity
            Not Before: May 24 02:03:23 2020 GMT
            Not After : Aug 22 02:03:23 2020 GMT
        Subject: CN=highschoolhelper.org

so that corresponds to the one above as ID 2850401771

Going to https://crt.sh/?id=2850401771 it is not marked yet at revoked (but will be):

Unless you click on "Check" near OCSP and then you get:

How to check if a letsencrypt certificate has been revoked

2 Answers2