Certificate Revocation List (CRL).

A CRL is a CA-signed document containing the serial numbers and revocation dates of certificates that should no longer be trusted, typically because the private key was compromised, the subject changed, or the certificate was misissued. The format is defined by RFC 5280: a signed structure with thisUpdate/nextUpdate timestamps and per-entry reason codes (e.g. keyCompromise, cessationOfOperation, affiliationChanged). Relying parties download the CRL from the URL in the certificate's CRLDistributionPoints extension and reject any certificate whose serial appears there.

CRLs have two structural weaknesses: freshness and size. Because a client trusts a cached CRL until nextUpdate, a certificate revoked mid-cycle can still be accepted for hours or days — the reason OCSP (RFC 6960) and OCSP stapling were introduced for near-real-time status. Size becomes acute during mass-revocation events: after Heartbleed (2014), operators reissued and revoked certificates en masse, and Cloudflare reported that publishing the resulting CRLs added roughly $400,000/month to one CA's bandwidth bill. Mozilla has measured about 3,000 CRLs totalling ~300 MB, which is why browsers moved to aggregated schemes rather than per-connection fetches.

Modern deployments favour compressed, pushed revocation data. Chrome ships CRLSets, and Firefox enabled CRLite — a Bloom-filter-cascade encoding of all WebPKI revocations from Certificate Transparency logs, refreshed every 12 hours and queried locally and privately — for all desktop users in Firefox 137. The CA/Browser Forum's push toward short-lived certificates (dropping toward 47-day maximum lifetimes by 2029) further reduces reliance on revocation altogether, since a certificate that expires quickly barely needs revoking.

flowchart TD
  A[Private key compromised / cert misissued] --> B[CA adds serial to CRL]
  B --> C[CA signs CRL with thisUpdate / nextUpdate]
  C --> D[Publish at CRLDistributionPoints URL]
  D --> E[TLS client / browser fetches CRL]
  E --> F{Cert serial in list?}
  F -->|Yes| G[Reject connection]
  F -->|No| H[Accept - trust until nextUpdate]
  C -.large lists, stale cache.-> I[OCSP stapling / CRLite / short-lived certs]
  style G fill:#c0392b,color:#fff
  style H fill:#27ae60,color:#fff