Browsers keep the CRL list (certificate revocation list) to check regularly about revoked certificates. The CA updates the CRL list to check any revoked certificate status. If the certificate is canceled or revoked (not expired), the browser shows a warning of the untrusted certificate. The CA signs the CRL to avoid certificate tampering.