# What Is CRLite? Definition and Examples

> CRLite is Mozilla's compact revocation dataset that lets Firefox check locally, without asking the CA, whether a publicly logged certificate is revoked.

Source: https://ssl.sh/glossary/crlite/
Last updated: 2026-11-10

CRLite is the revocation system Mozilla built for Firefox, based on a 2017 academic design. It compresses the revocation status of the certificates in [Certificate Transparency](https://ssl.sh/glossary/certificate-transparency/) logs from participating CAs into compact filters. Mozilla's servers collect the CRLs that CAs publish, combine them with CT data and push regular updates to Firefox, which then answers "is this certificate revoked?" locally. Because the filters are built against the complete set of known certificates, they give definite answers for covered certificates.

## Why it matters
Classic revocation checking forces a trade-off: live [OCSP](https://ssl.sh/glossary/ocsp/) queries leak browsing history and are usually soft-fail, while downloading full [CRLs](https://ssl.sh/glossary/crl/) is too heavy for a browser. CRLite avoids both. No per-site query reaches the CA, there is no added handshake latency, and an attacker cannot suppress the check by blocking a responder. It depends on CAs publishing complete CRLs and disclosing them to root programs, a data source that Ballot SC-063, which made CRLs mandatory, guarantees. Chrome takes a different approach with CRLSets, which cover a curated subset of revocations.

## Example
Suppose the private key for example.com leaks and the CA revokes the certificate. The serial number appears in the CA's next CRL, Mozilla's pipeline includes it in the next CRLite update, and Firefox users visiting example.com then see a revoked-certificate error (SEC_ERROR_REVOKED_CERTIFICATE). This works even if an attacker blocks all traffic to the CA.

## Common misconceptions
- **CRLite is just a downloaded CRL.** It is a compressed dataset derived from many CAs' CRLs and far smaller than the lists it is built from.
- **Bloom-filter-style data must produce false alarms.** CRLite's filters are constructed against the full set of logged certificates, so covered certificates get exact answers.
- **Chrome uses CRLite too.** Chrome uses its own CRLSets; CRLite is Mozilla's mechanism.

## Related terms

- [CRL](https://ssl.sh/zh/glossary/crl/): CRL 是由 CA 签名并定期重新发布的证书吊销列表，列出它在证书到期前就已吊销的证书序列号。
- [证书吊销](https://ssl.sh/zh/glossary/revocation/): 证书吊销是 CA 在证书到期前宣布其作废的操作，通过 CRL 或 OCSP 对外公布，使客户端不再信任这张证书。
- [OCSP](https://ssl.sh/zh/glossary/ocsp/): OCSP 是 RFC 6960 定义的在线证书状态协议，客户端可以向 CA 的响应服务器查询某一张证书当前是有效、已吊销还是未知。
- [证书透明度](https://ssl.sh/zh/glossary/certificate-transparency/): 证书透明度（CT）是一套公开、只可追加的日志系统，记录所有公开信任的 TLS 证书，让任何人都能审计 CA 签发了什么。
- [CT 日志](https://ssl.sh/zh/glossary/ct-log/): CT 日志是由独立运营方维护、可公开审计且只可追加的服务器，用 Merkle 树记录证书，并签发承诺收录的时间戳。
- [短期证书](https://ssl.sh/zh/glossary/short-lived-certificate/): 短期证书是有效期只有几天的 TLS 证书，靠快速过期而不是吊销来限制被盗证书可被滥用的时间。