revoked.badssl.com should be forked for OCSP vs. CRL

[BenWilson-Mozilla]

To enhance revocation testing, revoked.badssl.com should be forked and extended to include multiple test sites that simulate various revocation delivery mechanisms and revocation reasons. This expansion should include:

Separate test sites for OCSP vs. CRL-based revocation.
Certificates revoked with different reason codes (e.g., key compromise vs. no reason code provided).

These additions will improve the ability to test and validate revocation handling across different implementations.

[christhompson]

Different reason codes would be doable, but we would need to add a new subdomain which is non-trivial, so I don't know when this would be doable/deployed. We focused on shifting revoked.badssl.com to use a keyCompromise reason code so that we could fully automate it and test the case that matters for Chrome (triggering the revoked path via automated CRLSets) -- we don't have much use for manual testing of the other cases ourselves at this time.

Could you say more about how these distinct cases are helpful and exactly what behavior they would need to demonstrate? Would the OCSP end point just be a "not in CRLSets/CRLite but technically is revoked, plus the client was configured to check OCSP" case? Or would you need Stapling? (The latter would be much more complicated, the former is just you repurposing a "non-critical reason code" test case domain.)

In the interim, could you make use of CA-hosted revocation test endpoints (as required by the BRs IIRC)? Not sure if those give you the granularity you are looking for though.