CRL (Certificate Revocation List)

A Certificate Revocation List (CRL) is a signed file published by a certificate authority that lists the serial numbers of certificates it has revoked before their scheduled expiry. Clients download the list and refuse any certificate whose serial appears on it.

Why it matters

Certificates are valid until they expire, but keys get stolen and certificates get mis-issued. Revocation is the mechanism that lets a CA say "stop trusting this one now". Historically browsers did poorly at checking it, because lists can be large and a failed download is awkward to handle. Modern browsers often rely on compact, browser-curated revocation data instead of fetching each CA list live.

Revocation is moving toward CRLs: Let's Encrypt, for example, shut down its OCSP service in August 2025 and publishes CRLs instead.

Example

Certificates point to their CRL in the CRL Distribution Points extension:

openssl x509 -in cert.pem -noout -text | grep -A2 "CRL Distribution"

You can then download the listed URL and inspect it with openssl crl -inform DER -in list.crl -noout -text.

Common mistakes

• Assuming a revoked certificate is rejected everywhere. Client behavior varies and some clients never check.
• Treating revocation as a substitute for short lifetimes. Short-lived certificates reduce how long a stolen key is useful.
• Forgetting to revoke after a private key leak. Revoke through your CA and replace the key pair.

Related

• OCSP
• OCSP stapling
• Certificate authority
• टूल: SSL checker

यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.