CRL
In OPC UA, a CRL is the Certificate Revocation List a CA publishes listing certificates it has withdrawn before their expiry date. Each CA in your trusted or issuer store needs its current CRL in the matching crl directory, or validation reports revocation status as unknown rather than as good.
Four codes, and the difference between them
BadCertificateRevoked means the peer certificate is on a CRL you hold - stop, that is a real refusal. BadCertificateIssuerRevoked means a CA in its chain has been revoked. BadCertificateRevocationUnknown and BadCertificateIssuerRevocationUnknown mean you could not determine status because the CRL is absent, expired or unparseable. The unknown pair are the ones you meet daily, and they are configuration, not compromise.
CRLs expire, and that is the usual cause
A CRL carries a nextUpdate time, typically days or weeks out. Past that point a strict validator treats it as no longer authoritative and revocation becomes unknown again. That is why a PKI that worked at commissioning fails months later with nothing having changed: nobody automated the refresh. Whoever owns the CA must publish a fresh CRL on a schedule, and something on each device must fetch it - OPC UA applications generally read the local file and do not go out to a CRL distribution point themselves.
Self-signed certificates have no CRL at all
A self-signed peer certificate is its own issuer, so there is no CA to publish a revocation list. Stacks handle that differently: some treat a trusted self-signed certificate as needing no revocation check, others raise revocation-unknown. If you standardise on self-signed application certificates you are also accepting that your only revocation mechanism is deleting the certificate from every peer's trust list by hand - which is the strongest argument for a CA in any fleet above a handful of devices.
Suppressible, and what that means for you
Both revocation-unknown codes are in the suppressible set, so a validation callback can accept them, and most tools do by default. That is a defensible commissioning setting and a poor production one, because it means a certificate you revoked this morning is still accepted this afternoon. Decide deliberately: either run real CRL distribution and stop suppressing, or accept that revocation is not part of your security model and say so in the design.
Example
Checking whether a CRL is current, and whether a certificate is on it
openssl crl -in pki/crl/PlantRootCA.crl -noout -lastupdate -nextupdate
lastUpdate=Aug 11 02:00:00 2026 GMT
nextUpdate=Aug 18 02:00:00 2026 GMT # expired if today is later -> revocation unknown
# is a specific certificate listed?
openssl x509 -in own/certs/MyUaClient.der -inform der -noout -serial
serial=4A1B77C2E9
openssl crl -in pki/crl/PlantRootCA.crl -noout -text | grep -A1 4A1B77C2E9Defined in: Part 2 - Security Model; Part 12 - Discovery and Global Services for CRL distribution.
Last verified 7 September 2026 against OPC UA 1.05.07. OPC UA Connect is an educational resource and is not affiliated with the OPC Foundation.