Strata Copilot
    Next-Gen Trust Security
    : Certificate Revocation Status Monitoring
    Focus
    Focus
    1. Home
    2. Next‑Gen Trust Security
    3. Next-Gen Trust Security
    4. Next-Gen Trust Security Overview
    5. Start with the TLS Certificates Dashboard
    6. About Revoking Certificates
    7. Certificate Revocation Status Monitoring

    Next-Gen Trust Security

    Certificate Revocation Status Monitoring

    Table of Contents

    Certificate Revocation Status Monitoring

    Next-Gen Trust Security automatically checks the revocation status of non-expired, public (DNS-resolvable) certificates every six hours using Certificate Revocation Lists (CRLs). These checks apply only to leaf and intermediate certificates that are stored in the Certificates inventory.
    Important: Root certificates cannot be revoked and are not included in revocation status monitoring.

    Manually Search a Certificate's Revocation Information

    You can manually search and review the current revocation status of a certificate in Next-Gen Trust Security.
    1. Click Insights > Certificate Inventory > Certificates.
    2. On the Server tab, click a certificate name to open its details.You can also use filters to locate a specific certificate.
    3. Click the Revocation tab.

    Understanding Certificate Revocation Information

    The Revocation tab in the certificate details shows the certificate's revocation state as reported by the issuing CA, under Global Revocation. If someone requested revocation in Next-Gen Trust Security, Revocation Request Information shows the request's status, the requester, the comment, and any rejection reason. If there's nothing to show, the tab says No revocation information found.
    The following table describes the Global Revocation fields:
    FieldDescription
    Revocation StatusThe current trust status of the certificate as reported by the issuing CA. Possible values: NOT_REVOKED (certificate is active and trusted), REVOKED (certificate has been revoked), UNKNOWN (revocation status could not be verified, for example if the CA endpoint is unreachable). In the inventory's Revocation Status column, these appear as Valid, Revoked, and Unavailable.
    Revocation DateThe date and time when the certificate was officially revoked by the CA.
    Revocation ReasonThe reason provided by the issuing CA for revoking the certificate (for example, SUPERSEDED).

    © 2026 Palo Alto Networks, Inc. All rights reserved.