Revocation & Validity

What Is Certificate Revocation List (CRL)?

A Certificate Revocation List (CRL) is a signed, regularly republished file in which a CA lists every certificate it has revoked before expiry — by serial number, with revocation date and reason. Clients download the CRL from the distribution point (CDP) URL embedded in certificates and refuse serials on the list. It is the oldest revocation mechanism, and still the one whose failure hurts most.

How CRLs work

Each CRL carries thisUpdate/nextUpdate timestamps defining its freshness window, the issuing CA’s signature, and the revoked entries with reason codes (key compromise, cessation of operation, superseded…). Clients cache the CRL until nextUpdate — so revocation takes effect only as fast as the publication interval.

The expired-CRL outage

If a CA fails to publish before nextUpdate passes, every relying party that fails closed suddenly rejects all certificates from that CA — VPNs, Wi-Fi, LDAPS and applications simultaneously. This is the classic self-inflicted ADCS outage: the CA server was off, the CDP URL broke, or nobody owned the republish job. Monitoring CRL expiry is the cheapest insurance in PKI operations.

Size is the other operational axis: busy or government CAs produce CRLs of tens of megabytes, which strains embedded clients and startup paths. Delta CRLs and partitioned CRLs exist precisely to manage that growth.

CRL versus OCSP

OCSP answers about one serial in real time; a CRL answers about all serials with cache latency. Modern practice uses both — and after browsers built aggregated revocation feeds (CRLite, Chrome’s CRLSets), public CAs have actually re-emphasized CRLs. For your own CA: publish reliably, monitor expiry, and alert before nextUpdate, not after.

Try it yourself — free tools

CRL Checker — analyze any CRL — expiry countdown, revoked entries and health
OCSP Checker — check a single certificate’s status in real time instead

How MI Support IT can help

MI Support IT sets up CRL monitoring with email alerts before expiry — the control that prevents the classic ADCS full-stop outage. Read about our PKI services or get in touch.