CRL

CRL explained: the signed list a certificate authority publishes of revoked certificates, how it works, and how it differs from OCSP.

A CRL (Certificate Revocation List) is a signed file that a certificate authority publishes listing the serial numbers of certificates it has revoked before their expiry date, together with the revocation date and, often, a reason code. It carries a "this update" and "next update" timestamp, so a relying party knows how fresh the list is and when to fetch a new one. The CRL itself is signed by the CA, so its integrity can be checked like any other PKI artefact.

CRLs are one of two standard ways to check certificate revocation, the other being OCSP (Online Certificate Status Protocol). A CRL is downloaded as a whole file and checked locally, which works offline once fetched but can grow large and go briefly stale between updates; OCSP asks about one certificate at a time and gets a near-real-time answer but requires an online query. Many X.509 certificates list both a CRL distribution point and an OCSP responder, and long-term validation evidence often embeds a CRL to prove revocation status at signing time.