← Back to glossary
📃

CRL (Certificate Revocation List)

Encryption

TLS (Transport Layer Security) Certificate Authority (CA) Public Key Infrastructure (PKI) Certificate Revocation

CA-published list of revoked certificates; freshness and size trade-offs affect practical effectiveness.

Definition

CRLs are periodically updated and can be large; clients may not fetch them often, creating freshness gaps. Many ecosystems use short-lived certs and OCSP stapling for better results.

In plain English CA-published list of revoked certificates; freshness and size trade-offs affect practical effectiveness.

Why this matters

Why it matters: Stale revocation checks can leave users exposed.

Example

Example: Keep CRLs updated, use stapling where possible, and prefer short-lived certificates.