DataTerminology.comNEW
Also known as: CRL
A CA-signed list that identifies revoked but unexpired certificates, typically referenced by distribution point URIs.
DESCRIPTION
A Certificate Revocation List is a signed structure that enumerates revoked certificate serial numbers and revocation reasons. Clients fetch CRLs using URIs embedded in certificatesā CRL Distribution Point extensions. Delta CRLs provide incremental updates to reduce bandwidth and latency. CRLs complement or substitute OCSP for revocation checking, particularly in offline or high-privacy settings. Timely publishing, caching, and validation of CRLs are critical to prevent accepting compromised credentials.
ALTERNATIVE DEFINITIONS
IETF (RFC 5280)
A certificate revocation list (CRL) is a list of certificates that have been revoked by the CA that issued them, before their scheduled expiration date.
Highlights revocation before expiry and CA authority.
Cloudflare
A certificate revocation list (CRL) is a list of certificates that have been revoked by the certificate authority before their scheduled expiration date.
Vendor learning resource emphasizing CA-managed revocation.
RELATED TERMS
Certificate Authority X.509 Delta CRL CRL Distribution Point Revocation Reason Trust Store Public Key Infrastructure TLS Certificate
COMPETING TERMS
Online Certificate Status Protocol
RELATIONS
- Broader: List
KNOWLEDGE AREAS
Data Security Data Privacy & Compliance
TARGET AUDIENCE
Security Architect Cybersecurity Engineer Chief Information Security Officer Cloud Architect DevOps Engineer Software Developer
EXTERNAL SOURCES
- Wikipedia - Certificate revocation list
- IETF - CRL and delta CRL profile
- Microsoft Learn - Windows certificate revocation behavior
- Mozilla - Browser revocation checking guidance
TOP QUESTIONS
What is a Certificate Revocation List and why is it needed?
A CRL is a signed list of revoked certificates. It prevents relying parties from trusting compromised or misissued certificates before they naturally expire.
Category: Overview
How do clients find a CRL for a certificate?
They read the CRL Distribution Point extension in the certificate, then fetch and verify the signed CRL from the provided URI.
Category: Technical
What is the difference between a base CRL and a delta CRL?
A base CRL lists all revoked certificates; a delta CRL contains only changes since a base CRL, enabling more efficient updates.
Category: Concepts
When is OCSP preferable to CRLs?
OCSP provides near-real-time revocation status and smaller responses, which can reduce bandwidth and improve freshness in online environments.
Category: Alternatives
What are common mistakes in CRL management?
Publishing infrequently, using unreachable CRL URIs, failing to sign correctly, and ignoring cache lifetimes can break revocation checking.
Category: Mistakes
What is the risk if CRLs are not checked?
Clients may accept revoked certificates, enabling man-in-the-middle or impersonation attacks until the certificate expires.
Category: Risks
How large can CRLs get and does size matter?
Large CRLs can impact latency and memory; delta CRLs, partitioning, and OCSP can mitigate size and distribution challenges.
Category: Performance
Do all certificates include CRL distribution points?
It is common but not universal. Some environments rely solely on OCSP or proprietary mechanisms for revocation checks.
Category: Misunderstanding
How often should CRLs be updated?
Update frequency should reflect risk and policy, often daily or more frequently for high-trust ecosystems, with well-defined nextUpdate times.
Category: Best practices