# SC-061v4: new CRL entries must carry a revocation reason code

> SC-061v4 brought Mozilla's CRL reason code rules into the Baseline Requirements: since 2023-07-15 revoked TLS certificates get a meaningful reason code.

Source: https://ssl.sh/ballots/sc-061/
Last updated: 2026-11-10

SC-061v4 requires CAs to record why they revoked a TLS certificate. Since 2023-07-15, when a CA revokes a TLS certificate, the new [CRL](https://ssl.sh/glossary/crl/) entry must carry the reason code that fits the situation, such as keyCompromise or superseded, using the rules Mozilla had already put into its root store policy.

## What changed

SC-061v4 modified §4.9.1.1 (reasons for revoking a subscriber certificate) and §7.2.2 (CRL extensions) of the [Baseline Requirements](https://ssl.sh/glossary/baseline-requirements/). Each revocation reason in §4.9.1.1 now maps to a CRL reason: keyCompromise (#1) when the private key leaked or can be computed, superseded (#4) when the certificate was misissued or replaced, cessationOfOperation (#5) when the domain is no longer used, affiliationChanged (#3) when subscriber details changed, and privilegeWithdrawn (#9) when the CA withdraws the certificate, for example for misuse. A revocation without a stated reason is "unspecified", which is expressed by leaving the reasonCode extension out. The ballot was proposed by Mozilla and endorsed by Google Trust Services and Microsoft.

## Effective dates

The BR change took effect on 2023-07-15.

## Who is affected

SC-061v4 mainly affects CAs and anyone analysing revocations. Revocation reasons give relying parties and researchers a clearer picture, for example to tell key compromise apart from routine replacement.

## What to do

When you ask a CA to revoke a certificate, state the reason honestly: report a leaked key as key compromise, so the CA can also block the key under [SC-073](https://ssl.sh/ballots/sc-073/). With ACME you can pass the reason code in the revocation request.


| Field | Value |
|---|---|
| Ballot | SC-061v4 |
| Status | Passed |
| Adopted | 2023-04-01 |
| Effective | 2023-07-15 |
| BR version | 1.8.7 |
| Official page | https://cabforum.org/2023/03/02/ballot-sc061v4-new-crl-entries-must-have-a-revocation-reason-code/ |