{"id":12561,"date":"2020-07-22T10:59:57","date_gmt":"2020-07-22T14:59:57","guid":{"rendered":"https:\/\/www.thesslstore.com\/blog\/?p=12561"},"modified":"2023-05-25T12:22:45","modified_gmt":"2023-05-25T16:22:45","slug":"crl-explained-what-is-a-certificate-revocation-list","status":"publish","type":"post","link":"https:\/\/www.thesslstore.com\/blog\/crl-explained-what-is-a-certificate-revocation-list\/","title":{"rendered":"CRL Explained: What Is a Certificate Revocation List?"},"content":{"rendered":"\n

Need to revoke a certificate? There\u2019s a list for that\u2026<\/h2>\n\n\n\n

X.509 digital certificates are integral to public key infrastructure (PKI) and web security as a whole. But what happens when something goes wrong with one of those certificates or its keys? Any certificate can find its head on the chopping block, so to speak \u2014 or what\u2019s better known as being added to a certificate revocation list (CRL).<\/p>\n\n\n\n

We\u2019ve seen mass certificate revocations happen before. For example, Apple, Google and GoDaddy (and a few other CAs) revoked millions of certificates<\/a> last year due to the certificates having 63-bit serial numbers instead of 64-bit ones. And just earlier this year, we saw Let\u2019s Encrypt facing a mass certificate revocation<\/a> due to a bug in their code.<\/p>\n\n\n\n

But what exactly is a certificate revocation and how does it work? What is a certificate revocation list? And, moreover, what role does a CRL play in website security as a whole?<\/p>\n\n\n\n

Let\u2019s hash it out.<\/span><\/p>\n\n\n<\/span><\/span>\n\n\n\n

Defining CRLs: What Is a Certificate Revocation List?<\/h2>\n\n\n\n

The answer to your question about what a certificate revocation list (or CRL) is depends on whom you ask. For example, the National Institute of Standards and Technology (NIST)<\/a> defines a CRL as \u201cA list of revoked public key certificates created and digitally signed by a Certification Authority.\u201d<\/p>\n\n\n\n

But it\u2019s more than that. The more technical answer from the Internet Engineering Task Force\u2019s (IETF) RFC 5280<\/a> describes a CRL as a time-stamped and signed data structure that a certificate authority (CA) or CRL issuer periodically issues to communicate the revocation status of affected digital certificates. Depending on the provider, certificate revocation lists are offered hourly, daily, or weekly.<\/p>\n\n\n\n

But this description doesn\u2019t quite do it justice, either. Personally, I\u2019d prefer to define a certificate revocation list (CRL) as a blacklist of X.509 digital certificates<\/a> that a CA revokes prior to their assigned expiration dates.<\/strong> It\u2019s important to note, however, that this list doesn\u2019t include expired certificates. Furthermore, in some cases, third-party entities issue and maintain CRLs on behalf of CAs. This means that the CRL issuer isn\u2019t always the same as the CA who issued the revoked certificate.<\/p>\n\n\n\n

But before we can get into the nitty-gritty details of what a certificate revocation list fully entails, we first need to address what certificate revocation is in general.<\/p>\n\n\n\n

The Purpose of Certificate Revocation<\/h3>\n\n\n\n

Much like the name implies, certificate revocation is a process that distinguishes invalid and untrusted certificates from valid trusted ones. Basically, it\u2019s a way for CAs (or CRL issuers) to make it known that one or more of their digital certificates is no longer trustworthy for one reason or another.<\/strong> When they revoke a certificate (a process that\u2019s sometimes known as PKI certificate revocation), they essentially invalidate the cert ahead of its expiration date.<\/p>\n\n\n\n

So, should a CA need revoke a certificate for your website, it makes Google Chrome display a lovely warning message like this to your site visitors:<\/p>\n\n\n\n

\"Screenshot
This is a screenshot of an SSL\/TLS certificate revocation warning message in Google Chrome.<\/figcaption><\/figure><\/div>\n\n\n\n

Needless to say, it\u2019s definitely not a good look for your business\u2019s website. This message doesn\u2019t exactly foster warm and happy feelings of trust in your users\u2026 nor should it.<\/p>\n\n\n\n

Certificate Transparency Logs vs Certificate Revocation Lists: Aren\u2019t They the Same?<\/h3>\n\n\n\n

There is sometimes confusion about whether certificate transparency (CT) logs are the same as CRLs<\/a> or if they serve the same purposes. So, let me answer this question directly: No, CT logs and CRLs are not<\/em> the same thing.<\/strong> While they both deal with X.509 digital certificates, they\u2019re two separate processes that serve two separate functions.<\/p>\n\n\n\n

Certificate transparency logs<\/a> are a way for CAs to record every certificate that they issue for an individual domain. A CT log is, essentially, a certificate inventory for your domain. But this doesn\u2019t tell you whether a certificate is revoked. CRLs, on the other hand, are about informing clients whenever they revoke a certificate. But they don\u2019t include a list of every certificate that a CA issues for your domain.<\/p>\n\n\n\n

Why Would a CA Add Certificates to a CRL?<\/h2>\n\n\n\n

There isn\u2019t a one-size-fits-all answer for this question. A CA can revoke a certificate of your website for one of several reasons:<\/p>\n\n\n\n