CRL (certificate revocation list)
A certificate revocation list (CRL) is a signed, periodically published list of certificate serial numbers a certificate authority has revoked before their stated expiry, defined as part of the X.509 standard in RFC 5280. A client that wants to confirm a certificate hasn't been revoked downloads the current CRL from a URL the certificate itself specifies and checks whether the certificate's serial number appears on it -- a model that scales poorly as a CA's revoked-certificate count grows, since every check requires fetching and searching a potentially large, slowly updated list. OCSP was introduced specifically to replace this per-certificate lookup with a single targeted query, and OCSP stapling went further by letting the server supply that proof itself; even so, CRLs remain a required fallback in the X.509 standard, and some clients and CAs still rely on them as the primary revocation mechanism.
By AdminKit team, Netbase JSC · Updated