A certificate revocation list (CRL) is a certificate authority’s published list of certificates that are no longer valid. It gives browsers a way to learn that a certificate should not be trusted, even before its normal expiration. section 9.3
CRLs provide certificate revocation, but their practical weaknesses shaped later approaches:
- The certificate authority maintains a list of revoked certificates. section 9.3
- Clients must obtain and repeatedly check the list to detect revoked certificates. section 9.3
- Lists can become large, making constant checking inconvenient. section 9.3
- Online Certificate Status Protocol (OCSP) largely replaced CRLs with direct status queries; OCSP stapling later reduced some of its availability and privacy problems. section 9.3
When revocation matters
If a certificate is compromised, revocation can warn browsers not to trust it. Like a seatbelt, the mechanism may rarely activate but provides important defense in depth when needed. section 9.3
Figure 9.9 Certificate revocation on the web has had three popular solutions: Certificate Revocation Lists (CRLs), Online Certificate Status Protocol (OCSP), and OCSP stapling.
Compare CRLs, OCSP, and OCSP stapling as successive approaches to checking certificate status during web authentication. section 9.3
