Revocation URLs (CRL / OCSP)

What it means

Where clients can check whether the issuer has revoked this certificate before its expiry: CRL files and/or an OCSP responder.

Why it matters

A compromised key gets revoked, not just left to expire. Corporate firewalls that block these URLs cause mysterious slow TLS handshakes and 'revocation information not available' warnings.