Revoking a certificate
Individual certificates come and go. Most certificates last until they expire and are then renewed. Or maybe the service that was using the certificate is retired and has been turned off. But sometimes, a certificate is compromised. Maybe the private key for the certificate was uploaded to a public version control repository – in real life, this happens all the time. Maybe the private key was sent to the wrong person.
Once a certificate's private key has been compromised, that certificate can no longer be trusted. A malicious user could take that certificate and use it to 'man-in-the-middle' your previously secure SSL connection and intercept and read the sensitive traffic.
The way to limit the damage caused by this is to revoke the issued certificate. Most web browsers check something called a Certificate Revocation List (CRL) when establishing an SSL connection to check if a certificate has been revoked (in other words, blacklisted...