Revocation doesn't really work well. Attackers only have to DOS the connection to the revocation list, and then they can use the revoked certificate freely. The

Revocation doesn't really work well. Attackers only have to DOS the connection to the revocation list, and then they can use the revoked certificate freely. The revocation checks fail often enough that browsers don't even show a warning when this happens.