Certificate Revocation List (CRL)

A CRL is a CA-signed document containing the serial numbers and revocation dates of certificates that should no longer be trusted, typically because the private key was compromised, the subject changed, or the certificate was misissued. Relying parties such as browsers and TLS clients download the CRL from the location named in the CRLDistributionPoints extension and reject any certificate whose serial appears there. CRLs work offline once cached but can grow large and may be hours or days out of date, which is why OCSP and OCSP stapling, short-lived certificates, and CRLite-style compressed lists are increasingly preferred in modern deployments.