Amazon CloudFront Adds Real-Time Certificate Revocation Checking with OCSP for mTLS Viewers

CloudFront enhanced mutual TLS (mTLS) authentication by integrating Online Certificate Status Protocol (OCSP) to dynamically validate client certificate revocation during connection establishment.

By Maya Bennett · Editorial pseudonym · 2026-05-14 · 1 min read

AI-ASSISTED REPORTING · RETROSPECTIVE ARCHIVE

Retrospective edition: 2026-05-14. Source published: 2026-05-14. Added to this archive: 2026-11-03. This briefing was prepared later from the linked announcement; it was not published on this website on the historical edition date.

Previously reliant on static revocation lists maintained manually, CloudFront's mTLS viewer authentication now queries the client certificate's embedded OCSP responder to check revocation status live. This ensures only valid client certificates are accepted, meeting strict compliance and zero-trust security requirements.

OCSP responses are cached up to 30 minutes to balance latency and security. The revocation status can be accessed within CloudFront connection functions, allowing customized edge logic such as grace periods or hybrid revocation checks without additional cost to users.

Source & further reading

Amazon CloudFront announces support for OCSP Revocation for Mutual TLS (Viewer) ↗

Source published 2026-05-14. This report was prepared with AI assistance from the linked primary-source material. Claims and limitations should be checked against the original announcement or research.