Certificate Revocation
Problem
A certificate is valid until December.
Its private key is stolen in September.
Waiting until December is unacceptable.
Solution — Revocation
The certificate ecosystem can publish that a certificate should no longer be trusted, using mechanisms such as CRLs or OCSP.
Core idea: revocation provides a way to distrust a certificate before its normal expiration.