OCSP Evaluator

Is the certificate of this site revoked? Your own browser asks the authority that issued it, with OCSP and CRL. No third-party server.

Version 1.0.0 · Manifest V3 · Firefox 142+ and Firefox for Android 142+ · Apache 2.0 · no data collected, no third-party server

Add to Firefox Source code (git)What's new in 1.0

Valid certificate, not revoked, grade A+

Warning page for a site with a revoked certificate

Why revocation matters

When the private key of a certificate is stolen or the certificate was issued by mistake, the authority that issued it revokes it. Until it expires, a revoked certificate can still be used to impersonate the site. OCSP Evaluator tells you whether the certificate of the site you are visiting is still valid or has been revoked.

How it works

Reads the real certificate chain of the page from Firefox itself (webRequest.getSecurityInfo).
Asks the issuing authority directly: OCSP first, the CRL when OCSP is not available. The signatures of the answers are verified.
Intermediate certificates are checked too.
Only the OCSP and CRL addresses written inside the certificate are contacted. Version 0.3 sent the sites you visited to an external service (ocspchecker.com); 1.0 removes that completely.

The panel

Grade from A+ to F, expiry, issuer, validation type (DV / OV / EV), TLS version and key algorithm.
The full certificate chain, with the details of each certificate and of its revocation check.
Check again, copy the certificate as PEM, save the chain, export a report.
Check any site on demand, and a history of recent checks.

When a certificate is revoked

You choose what happens:

Mode	What it does
Warn me (default)	Badge and notification, the page opens normally.
Stop the page	The page is held until the check is done; if the certificate is revoked you see a warning first.
Strict	Also stops pages whose status cannot be confirmed (responder offline, timeout).

Settings: what to do when a certificate is revoked

Certificate monitor

Add your own domains, your bank, your shop: they are checked in the background every 12 hours, and you get a notification when a certificate is revoked, about to expire or replaced.

Firefox for Android

The same checks on your phone, with a touch interface. Open the panel from ⋮ → Extensions → OCSP Evaluator. Light and dark theme, English and Italian.

Permissions

Permission	Why
Access your data for all websites	Read the certificate of any https site you open (the page content is never read).
webRequest, webRequestBlocking	Get the certificate chain of the page from Firefox and, if you choose “Stop the page” or “Strict”, show the warning page before a revoked site loads.
tabs	Know which site is open in the current tab, to show its result in the panel and on the toolbar icon.
storage	Your settings, the monitored domains, the history and a short cache of results.
alarms	Run the certificate monitor every 12 hours.
notifications	Tell you when a certificate is revoked, about to expire or replaced.

No third-party server: see Privacy.

Source code

Plain, unminified source with no build step and no third-party libraries: the certificates and the OCSP and CRL answers are read by the add-on's own ASN.1 parser. Get it with git clone https://git.code.sf.net/p/ocsp-evaluator/code ocsp-evaluator, or download it from Files.