CRL
acronymcryptographysecurity
Stands for: Certificate Revocation List
A published list of certificates that have been revoked.
Certificate Revocation List (RFC 5280) is a signed list a CA publishes of certificates no longer valid before their expiry. A client may download the CRL, or use the lighter-weight OCSP, to check whether a certificate has been revoked.
A certificate revocation list is a signed list of certificates an authority has revoked before their expiry. It is the original revocation mechanism and it scales badly, because a client must fetch a list that grows without bound and is often stale by the time it is used.
That is why the industry moved to OCSP and then to stapling, and then largely to short certificate lifetimes, which sidestep revocation by making certificates expire before a revocation would have mattered. Browsers now generally use curated aggregate lists of high-value revocations rather than checking per-certificate, having concluded that a check which fails open provides little security and a check which fails closed breaks the web.
Also known as: crl