RFC 7525: Recommendations for Secure Use of TLS and DTLS (rfc-editor.org)

Same link but with section hrefs: http://www.rfcreader.com/#rfc7525

It's really a shame that there's still no good way to revoke a certificate [0].

Mozilla has been discussing it for years [1] but an implementation or even a chosen direction is far from reality.

[0] http://www.rfcreader.com/#rfc7525_line799

[1] https://bugzilla.mozilla.org/show_bug.cgi?id=901698