ZertifikatsRevocationLists

ZertifikatsRevocationLists, often abbreviated as CRLs, are digital documents used in public key infrastructure (PKI) to manage the status of digital certificates. When a certificate is issued, it is considered trusted until its expiry date. However, circumstances may arise that require a certificate to be invalidated before its scheduled expiration. This can include situations where the private key associated with the certificate has been compromised, the certificate is no longer needed, or the information within the certificate has become inaccurate.

A CRL is a list of certificates that have been revoked by the issuing Certificate Authority (CA). Each entry in a CRL typically includes the serial number of the revoked certificate and the date of revocation. The CA periodically publishes updated CRLs. Relying parties, such as web browsers or email clients, can then check the CRL to determine if a presented certificate is still valid or has been revoked.

The process of checking a CRL involves downloading the latest CRL from a designated distribution point specified in the certificate itself. The relying party then compares the serial number of the certificate being validated against the serial numbers listed in the CRL. If a match is found, the certificate is considered untrusted, even if its expiration date has not yet passed. While CRLs are a fundamental mechanism for certificate revocation, their effectiveness can be limited by the frequency of CRL updates and the time it takes for a new CRL to be published and distributed. This can lead to a window of vulnerability where a revoked certificate might still be considered valid.