Use a signed webhook to learn about a revocation quickly, then periodically reconcile your local records against the issuing authority’s current status. The webhook is the fast path; reconciliation repairs missed, delayed, duplicated, or out-of-order notifications. Neither path alone guarantees a particular time to enforcement: the result depends on when the authority accepts and publishes the revocation, how quickly the event arrives and is processed, and how fresh your status data is.
What “revocation latency” includes
Set a maximum acceptable interval from an accepted revocation to enforcement in every system that relies on the key or certificate. That interval is made up of several delays, not just webhook delivery:
As an Amazon Associate I earn from qualifying purchases.
- Authority processing: the time between receiving a valid revocation request and reflecting it in the authority’s status source.
- Notification: the time for the webhook to reach your receiver, if the provider sends one.
- Local handling: the time to authenticate, persist, process, and apply the change.
- Status freshness: the age of the status information used by relying systems, including any cache or replication delay.
Choose the objective for the whole path. A fast webhook cannot compensate for a relying service that continues using stale cached status, and frequent polling cannot detect a change before the authority exposes it.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallWhy combine webhooks with scheduled polling?
A webhook can communicate a change as it happens, avoiding the wait for the next scheduled check. But delivery guarantees, retry windows, event ordering, and rate limits vary by provider. A receiver can be unavailable, an event can be rejected, or retries can eventually stop. Treat the notification as a prompt to update state, not proof that your local record is complete.
#1 Best Overall
Polling provides a separate repair path: compare local state with the authority’s current status and correct missed transitions. Polling alone may leave a change undiscovered until the next check. Together, the paths provide fast notification when delivery succeeds and eventual repair when it does not. This combined pattern is an architecture recommendation, not a guarantee specified by a certificate standard.
| Approach | Latency and freshness | Completeness and operational trade-off |
|---|---|---|
| Webhook only | Can deliver a change without waiting for a polling interval. | Depends on provider-specific delivery, retry, ordering, and receiver availability; without reconciliation, a missed event can leave local state stale. |
| Polling only | A change may wait until the next successful check; the cadence and status-source freshness shape the delay. | Can discover current state without relying on a particular event delivery, but frequent checks increase API load and may be constrained by rate limits. |
| Webhook plus polling | Uses events for prompt updates and scheduled checks to detect drift. | Requires both a secure, durable event receiver and a reconciliation process, with deduplication and rate-aware polling. |
Choose the status source for the credential
Certificate revocation: OCSP and CRLs
For X.509 certificates, the authority’s status mechanisms matter. A Certificate Revocation List (CRL) is published on a schedule. RFC 5280 (2008) gives illustrative schedule-dependent examples in which a revocation report might not reliably appear in currently issued CRLs for up to one hour, one day, or one week. Those figures describe examples tied to CRL issuance frequency; they are not universal latency measurements or guarantees.
Rank #2
The Online Certificate Status Protocol (OCSP) supports online status queries and can reduce the wait associated with periodic CRL publication, but the client must validate the response rather than trusting a successful network exchange. OCSP status values are good, revoked, and unknown. In RFC 6960 (2013), good means at minimum that the requested serial number is not currently revoked; it does not necessarily prove that the certificate was issued.
Freshness fields help interpret a response: thisUpdate is when the responder knows the status to be correct, nextUpdate indicates when newer information is expected, and producedAt records when the response was signed. The relying client must assess whether the response is recent enough for its policy.
High-volume OCSP deployments
RFC 9919, published in July 2026, updates the lightweight OCSP profile for high-volume environments with measures including response pre-production, smaller messages, and caching. Where a certificate identifies both an OCSP responder and a CRL distribution point, its guidance is to try OCSP first; a client may retrieve the CRL after a locally configured timeout and retry count. That profile concerns OCSP and does not define webhook delivery or a universal polling cadence.
For other kinds of keys, use the issuing system’s documented authoritative status endpoint or current-state API. The event schema, supported query method, pagination semantics, and limits depend on that provider; do not assume a certificate protocol or another service’s webhook rules apply.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Build the two paths
- Define the objective. Set the maximum acceptable time from accepted revocation to enforcement. Include authority processing, event delivery, local work, and status-cache freshness in the budget. The standards cited here do not establish one target suitable for every system.
- Receive over HTTPS and authenticate the sender. Verify the webhook signature using the provider’s documented signing scheme and secret or key lifecycle. Validate the event type and relevant credential identifiers before changing trust state. Do not copy another provider’s signature headers or verification procedure.
- Persist before acknowledging. Durably record or enqueue the event, and deduplicate it using the provider’s stable event or delivery identifier. Keep the request handler short, then do slower processing asynchronously. Acknowledge only once the event has been safely accepted under your durability design.
- Apply the change idempotently. Reprocessing the same event should converge on the same local status without repeating unsafe side effects. Do not assume events arrive in order or that receiving one event means every earlier change was delivered.
- Reconcile on a schedule. Query the authoritative current-state source using its supported cursor, time window, or full-state listing. Compare remote status with local records and repair differences. If pagination or event-time semantics can omit changes at a boundary, use documented overlap and deduplication rules.
- Set and operate the polling cadence. Choose an interval against the latency objective, provider rate limits, and expected service load. If a status change becomes visible immediately and checks succeed on schedule, the next check adds at most roughly one polling interval before detection, plus query and processing time. Authority publication delays, failed checks, or stale caches can add more. Back off on transient errors and alert when the last successful reconciliation becomes too old.
GitHub and OpenAI documentation illustrate why provider behavior must be checked rather than generalized: GitHub recommends a 2xx response within 10 seconds, while OpenAI documents webhook retries for up to 72 hours with exponential backoff. These are provider-specific examples, not universal webhook standards or commitments for other senders.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteHandle status and delivery failures explicitly
Webhook failures
- Reject events whose signature, sender identity, event type, or credential identifiers fail validation; record the rejection without applying the change.
- Make duplicates harmless through stable-ID deduplication and idempotent updates. Keep enough processing state to distinguish received, durably queued, and applied events.
- Do not rely on retries as your repair plan. Retry duration and behavior vary, and even a long retry window has an end.
- Keep scheduled reconciliation enabled after an unverifiable event, receiver outage, processing failure, or suspected delivery gap.
Certificate-status failures
For OCSP, validate the response signature, responder identity and authority, certificate match, and freshness before using the answer. Define policy for unknown, stale responses, responder errors, and outages; a transport-level success is not itself a valid status result. RFC 6960 permits CRL processing as a fallback when the status service cannot be reached, but the appropriate behavior depends on the relying system’s security requirements.
Measure whether the design meets its objective
Instrument the complete path so operators can distinguish a slow authority from a delayed event, a blocked queue, or stale status. Useful measures include:
- time from event creation or provider timestamp to receiver acceptance, when the provider supplies a trustworthy timestamp;
- time from durable receipt to enforcement;
- age of the last successful reconciliation and the number of records corrected by it;
- signature-validation failures, duplicate deliveries, and processing errors;
- polling errors, rate-limit responses, and age of the status data used by relying services.
These measures are operational recommendations, not evidence of a published speedup for this exact architecture. RFC 6484’s RPKI-specific policy illustrates that polling frequency must account for repository load; it is not a general cadence prescription for unrelated systems. The cited standards and provider examples do not quantify an average reduction in revocation latency from combining webhooks with polling.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
