CRl

CRL most commonly refers to a Certificate Revocation List in public key infrastructure (PKI). It is a list published by a certificate authority of certificates that have been revoked before their expiration and should no longer be trusted.

Contents and structure: Each entry includes the serial number of the revoked certificate, the revocation date, and the reason code. The list is digitally signed by the issuing CA and includes metadata such as the issuing CA name, the issuer's key, issue date, and nextUpdate. The CRL is itself a data structure defined by the X.509 standard and RFC 5280.

Distribution and validation: CRLs are published to publicly accessible locations called CRL distribution points, and clients download or fetch them as part of certificate validation. To validate a certificate, a client checks that its serial number is not present in the CRL and that the CRL is not expired. Some systems use delta CRLs to minimize bandwidth; otherwise, full CRLs may be large.

Alternatives and limitations: The primary online alternative is the Online Certificate Status Protocol (OCSP), which queries the status of a single certificate in real time. CRLs can introduce latency and bandwidth challenges for large PKIs; OCSP stapling or OCSP Must-Staple can mitigate these issues. Effective use of CRLs requires robust distribution, timely updates, revocation policies, and audit trails.

See also and standards: CRLs are part of PKI governed by the X.509 framework and related standards such as RFC 5280. CRL management is a core aspect of certificate lifecycle and trust domain administration.