CRL vs OCSP: How Certificate Revocation Checking Works
When a certificate must be distrusted before it expires, the CA revokes it. Relying parties find out in one of two ways: by downloading the CA’s Certificate Revocation List (CRL) or by asking the CA’s OCSP responder about one specific certificate. This guide explains both and when each matters.
How a CRL works
A CRL is a signed, periodically republished list of all revoked certificate serial numbers from one CA. Clients download the whole list from the CRL distribution point (CDP) URL embedded in the certificate and check whether the serial number appears on it.
CRLs are simple and cacheable, but they grow large (government CA CRLs can reach tens of megabytes), and a client is only as up to date as its last download — the "next update" timestamp defines how stale a cached CRL may be.
How OCSP works
OCSP (Online Certificate Status Protocol) flips the model: instead of downloading everything, the client asks the CA’s OCSP responder about a single serial number and gets a signed good/revoked/unknown answer in real time.
OCSP stapling improves both privacy and performance by letting the web server fetch its own OCSP response and attach it to the TLS handshake, so the client never contacts the CA directly.
Which one should you monitor?
If you operate a CA or depend on one, monitor both: the CRL for expiry (an expired CRL can take down every relying application at once) and the OCSP responder for availability and correct answers. Many real-world outages are simply a CRL that passed its next-update time.
Paste a CRL URL to see expiry, next update, revoked certificates and revocation reasons — or use the OCSP Checker for a single certificate’s live status.
Open the CRL Checker →Frequently asked questions
What happens when a CRL expires?
Relying software treats revocation status as unknown; depending on policy this can fail closed and block every certificate from that CA — one of the most common self-inflicted PKI outages.
Is OCSP replacing CRLs?
No — they coexist. Several public CAs have actually moved back toward CRLs since browsers built their own aggregated revocation feeds, while OCSP remains standard for many enterprise and TLS scenarios.
How do I find the CRL or OCSP URL for a certificate?
Both are embedded in the certificate: the CRL distribution point (CDP) extension holds the CRL URL, and the Authority Information Access (AIA) extension holds the OCSP responder URL.
Need help beyond the tools? MI Support IT provides enterprise PKI consulting — ADCS, Venafi automation, key ceremonies and CP/CPS documentation.