# What Is CRL (Certificate Revocation List)? Definition and Examples

> A CRL is a list, signed and periodically reissued by a CA, of the serial numbers of certificates it revoked before their expiry date.

Source: https://ssl.sh/glossary/crl/
Last updated: 2026-11-10

A CRL (Certificate Revocation List) is a signed data structure, profiled in [RFC 5280](https://www.rfc-editor.org/rfc/rfc5280), that lists the serial numbers of certificates a CA has revoked, each with a revocation date and an optional reason code such as keyCompromise or superseded. It carries thisUpdate and nextUpdate fields, and certificates point to it through the CRL Distribution Points extension. Large CAs split their lists into many smaller, partitioned CRLs.

## Why it matters
CRLs are now the backbone of web PKI [revocation](https://ssl.sh/glossary/revocation/). CA/Browser Forum Ballot SC-063 (effective 2024-03-15) made CRLs mandatory for publicly trusted TLS CAs while OCSP became optional, and Let's Encrypt publishes CRLs after ending OCSP. Browsers rarely download CRLs during a handshake; instead they aggregate them: Chrome builds CRLSets, and Mozilla builds [CRLite](https://ssl.sh/glossary/crlite/) from the CRLs that CAs disclose to root programs. Under the same ballot, short-lived certificates (7 days or less, for certificates issued from 2026-03-15) need not carry CRL or OCSP pointers at all.

## Example
```bash
# Where is the CRL for this certificate?
openssl x509 -in cert.pem -noout -ext crlDistributionPoints

# Download and inspect it (CRLs are usually DER-encoded)
curl -sO http://crl.example.com/1.crl
openssl crl -in 1.crl -inform DER -noout -text | head -20
```

The output shows Last Update and Next Update, followed by entries with a Serial Number and a Revocation Date.

## Common misconceptions
- **CRLs are obsolete and OCSP replaced them.** The opposite happened: CRLs are mandatory and OCSP is optional.
- **Revocation shows up in real time.** A CRL reflects the CA's state at thisUpdate; a new revocation appears only when the next CRL is published and clients pick it up.
- **Clients download the CRL on every connection.** Mainstream browsers rely on aggregated revocation data, not per-connection downloads.

## Related terms

- [证书吊销](https://ssl.sh/zh/glossary/revocation/): 证书吊销是 CA 在证书到期前宣布其作废的操作，通过 CRL 或 OCSP 对外公布，使客户端不再信任这张证书。
- [OCSP](https://ssl.sh/zh/glossary/ocsp/): OCSP 是 RFC 6960 定义的在线证书状态协议，客户端可以向 CA 的响应服务器查询某一张证书当前是有效、已吊销还是未知。
- [CRLite](https://ssl.sh/zh/glossary/crlite/): CRLite 是 Mozilla 为 Firefox 打造的压缩吊销数据集，浏览器无需联系 CA，就能在本地判断公开记录的证书是否已被吊销。
- [X.509](https://ssl.sh/zh/glossary/x509/): X.509 是 ITU-T 制定的公钥证书标准格式，其互联网配置规范 RFC 5280 规定了 TLS 所用证书的结构和验证方法。
- [证书颁发机构](https://ssl.sh/zh/glossary/certificate-authority/): 证书颁发机构（CA）是负责审核申请者、签发数字证书，并把公钥与域名或身份绑定在一起的机构。
- [证书序列号](https://ssl.sh/zh/glossary/certificate-serial-number/): 证书序列号是 CA 为每张证书分配的正整数，与颁发者名称一起唯一标识一张证书，吊销列表和 OCSP 都靠它定位证书。
- [短期证书](https://ssl.sh/zh/glossary/short-lived-certificate/): 短期证书是有效期只有几天的 TLS 证书，靠快速过期而不是吊销来限制被盗证书可被滥用的时间。