What is Improper Check for Certificate Revocation (CWE-299)?

TL;DR: Improper Check for Certificate Revocation (CWE-299) is a security flaw where products fail to verify the revocation status of certificates, potentially leading to unauthorized access and data tampering. Fix it by validating certificate revocation status.

What is Improper Check for Certificate Revocation?

Improper Check for Certificate Revocation (CWE-299) is a type of security vulnerability that occurs when a product does not verify the revocation status of a certificate. As defined by the MITRE Corporation under CWE-299, and classified by the OWASP Foundation under A07:2025 - Authentication Failures.

Quick Summary

Improper Check for Certificate Revocation is critical because it can lead to trusting compromised or revoked certificates, which may result in unauthorized access and data tampering. This vulnerability affects systems that rely on TLS/SSL and PKI systems for secure communication. Jump to: Overview · How It Works · Business Impact · Attack Scenario · Detection · Fixing · Framework-Specific Fixes · Ask AI · Best Practices · FAQ · Related Vulnerabilities

Jump to: Quick Summary · Improper Check for Certificate Revocation Overview · How Improper Check for Certificate Revocation Works · Business Impact of Improper Check for Certificate Revocation · Improper Check for Certificate Revocation Attack Scenario · How to Detect Improper Check for Certificate Revocation · How to Fix Improper Check for Certificate Revocation · Framework-Specific Fixes for Improper Check for Certificate Revocation · How to Ask AI to Check Your Code for Improper Check for Certificate Revocation · Improper Check for Certificate Revocation Best Practices Checklist · Improper Check for Certificate Revocation FAQ · Vulnerabilities Related to Improper Check for Certificate Revocation · References · Scan Your Own Site

Improper Check for Certificate Revocation Overview

What

Improper Check for Certificate Revocation is a security flaw where products fail to verify the revocation status of certificates before use.

Why it matters

This vulnerability can lead to trusting compromised or revoked certificates, which may result in unauthorized access and data tampering.

Where it occurs

It affects systems that rely on TLS/SSL and PKI systems for secure communication.

Who is affected

Applications and services using insecure certificate validation mechanisms are at risk.

Who is NOT affected

Systems already validating certificates against CRLs or OCSP are not vulnerable to this issue.

How Improper Check for Certificate Revocation Works

Root Cause

The root cause of Improper Check for Certificate Revocation lies in the lack of proper revocation status checks before using a certificate.

Attack Flow

1. Attacker obtains a revoked or compromised certificate.
2. The attacker uses this certificate to impersonate a trusted entity.
3. The system fails to verify the revocation status and trusts the malicious certificate.

Prerequisites to Exploit

• An existing, compromised certificate.
• A system that does not check for certificate revocation status.

Vulnerable Code

def validate_certificate(cert):
    # No revocation status check performed here
    return True

This code snippet demonstrates a lack of validation logic to verify the revocation status of the certificate.

Secure Code

import ocsp

def validate_certificate(cert):
    try:
        response = ocsp.get_response(cert)
        if not response.is_valid():
            raise ValueError('Certificate is revoked')
    except Exception as e:
        raise ValueError(f'Failed to verify certificate: {e}')

This secure code checks the revocation status of a certificate using OCSP before allowing it to be used.

Business Impact of Improper Check for Certificate Revocation

Confidentiality

Data may be disclosed to an entity impersonating a trusted entity, resulting in information disclosure.

Integrity

Data from an untrusted source may be integrated into the system, leading to data tampering and corruption.

Availability

Trust assigned to an entity who is not who it claims to be can disrupt services or operations.

Improper Check for Certificate Revocation Attack Scenario

1. Attacker obtains a revoked certificate.
2. The attacker uses this certificate to impersonate a trusted server.
3. A client connects to the malicious server, trusting its identity due to lack of revocation status checks.
4. The attacker gains unauthorized access or performs data tampering.

How to Detect Improper Check for Certificate Revocation

Manual Testing

• Review configuration files and ensure proper validation logic is in place.
• Verify that certificates are checked against CRLs or OCSP before use.

Automated Scanners (SAST / DAST)

Static analysis can identify code snippets without revocation status checks. Dynamic testing requires running the application to observe certificate validation behavior.

PenScan Detection

PenScan’s scanner engines such as SSLyze and ZAP can detect improper check for certificate revocation vulnerabilities.

False Positive Guidance

A false positive may occur if a system performs proper revocation status checks but does not report them due to configuration or implementation details.

How to Fix Improper Check for Certificate Revocation

• Ensure certificates are checked against CRLs or OCSP before use.
• Implement mechanisms to validate certificate revocation status properly.

Framework-Specific Fixes for Improper Check for Certificate Revocation

Python

import ocsp

def validate_certificate(cert):
    try:
        response = ocsp.get_response(cert)
        if not response.is_valid():
            raise ValueError('Certificate is revoked')
    except Exception as e:
        raise ValueError(f'Failed to verify certificate: {e}')

How to Ask AI to Check Your Code for Improper Check for Certificate Revocation

Improper Check for Certificate Revocation Best Practices Checklist

✅ Ensure certificates are checked against CRLs or OCSP before use. ✅ Implement mechanisms to validate certificate revocation status properly.

Improper Check for Certificate Revocation FAQ

How does an attacker exploit improper check for certificate revocation?

An attacker can use a revoked or compromised certificate to impersonate a trusted entity, leading to unauthorized access or data tampering.

What are the consequences of not checking for certificate revocation?

Not checking for certificate revocation can result in trusting an untrusted source and potentially exposing sensitive information.

How do I validate certificates properly?

Ensure that all certificates are checked against a Certificate Revocation List (CRL) or Online Certificate Status Protocol (OCSP).

Can you provide an example of vulnerable code for improper check for certificate revocation?

Vulnerable code does not include any checks to verify the revocation status of a certificate before using it.

How can I detect improper check for certificate revocation in my application?

Use automated scanners and manual testing techniques such as reviewing configuration files and checking for proper validation logic.

What is the impact on business if this vulnerability exists?

data breach, financial loss, and damage to reputation.

How can I prevent improper check for certificate revocation in my application?

Implement mechanisms to validate certificates against CRLs or OCSP before allowing them to be used.

Vulnerabilities Related to Improper Check for Certificate Revocation

References

• MITRE - CWE-299
• OWASP Top 10: A07:2025 - Authentication Failures
• NVD - National Vulnerability Database

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Improper Check for Certificate Revocation and other risks before an attacker does.