A Certificate Revocation List (CRL) is a signed file published by a certificate authority that lists the serial numbers of certificates it has revoked before their scheduled expiry. Clients download the list and refuse any certificate whose serial appears on it.
Why it matters
Certificates are valid until they expire, but keys get stolen and certificates get mis-issued. Revocation is the mechanism that lets a CA say "stop trusting this one now". Historically browsers did poorly at checking it, because lists can be large and a failed download is awkward to handle. Modern browsers often rely on compact, browser-curated revocation data instead of fetching each CA list live.
Revocation is moving toward CRLs: Let's Encrypt, for example, shut down its OCSP service in August 2025 and publishes CRLs instead.
Example
Certificates point to their CRL in the CRL Distribution Points extension:
openssl x509 -in cert.pem -noout -text | grep -A2 "CRL Distribution"You can then download the listed URL and inspect it with openssl crl -inform DER -in list.crl -noout -text.
Common mistakes
- Assuming a revoked certificate is rejected everywhere. Client behavior varies and some clients never check.
- Treating revocation as a substitute for short lifetimes. Short-lived certificates reduce how long a stolen key is useful.
- Forgetting to revoke after a private key leak. Revoke through your CA and replace the key pair.
Related
Get notified when this term updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.