In cryptography, a Certificate Revocation List (or CRL) is “a list of digital certificates that have been revoked by the issuing certificate authority (CA) before their scheduled expiration date and should no longer be trusted”. CRLs are a type of blacklist and are used by various endpoints, including Web browsers, to verify whether a certificate is valid and trustworthy. Digital certificates are used in the encryption process to secure communications, most often by using the TLS/SSL protocol. The certificate, which is signed by the issuing Certificate Authority, also provides proof of the identity of the certificate owner.
There are two different states of revocation defined in RFC 5280:
A certificate is irreversibly revoked if, for example, it is discovered that the certificate authority (CA) had improperly issued a certificate, or if a private-key is thought to have been compromised. Certificates may also be revoked for failure of the identified entity to adhere to policy requirements, such as publication of false documents, misrepresentation of software behavior, or violation of any other policy specified by the CA operator or its customer. The most common reason for revocation is the user no longer being in sole possession of the private key (e.g., the token containing the private key has been lost or stolen).
This reversible status can be used to note the temporary invalidity of the certificate (e.g., if the user is unsure if the private key has been lost). If, in this example, the private key was found and nobody had access to it, the status could be reinstated, and the certificate is valid again, thus removing the certificate from future CRLs.
Publishing revocation lists
A CRL is generated and published periodically, often at a defined interval. A CRL can also be published immediately after a certificate has been revoked. A CRL is issued by a CRL issuer, which is typically the CA which also issued the corresponding certificates, but could alternatively be some other trusted authority. All CRLs have a lifetime during which they are valid; this timeframe is often 24 hours or less. During a CRL’s validity period, it may be consulted by a PKI-enabled application to verify a certificate prior to use.
To prevent spoofing or denial-of-service attacks, CRLs usually carry a digital signature associated with the CA by which they are published. To validate a specific CRL prior to relying on it, the certificate of its corresponding CA is needed.
The certificates for which a CRL should be maintained are often X.509/public key certificates, as this format is commonly used by PKI schemes. Each entry in a Certificate Revocation List includes the serial number of the revoked certificate and the revocation date. The CRL file is signed by the Certificate Authority to prevent tampering. Optional information includes a time limit if the revocation applies for only a period of time and a reason for the revocation. CRLs contain certificates that have either been irreversibly revoked (revoked) or that have been marked as temporarily invalid (hold).
Revocation versus expiration
Expiration dates are not a substitute for a CRL. While all expired certificates are considered invalid, not all unexpired certificates should be valid. CRLs or other certificate validation techniques are a necessary part of any properly operated PKI (Public-Key Infrastructure), as mistakes in certificate vetting and key management are expected to occur in real world operations.
Digital certificates are revoked for many reasons. If a CA discovers that it has improperly issued a certificate, for example, it may revoke the original certificate and reissue a new one. Or if a certificate is discovered to be counterfeit, the CA will revoke it and add it to the CRL. The most common reason for revocation occurs when a certificate’s private key has been compromised. Other reasons for revoking a certificate include the compromise of the issuing CA, the owner of the certificate no longer owning the domain for which it was issued, the owner of the certificate ceasing operations entirely or the original certificate being replaced with a different certificate from a different issuer.
(SANTA CLARA, Calif.—April 20, 2021) The Physical Security Interoperability Alliance (PSIA) today announced its Secure Credential Interoperability (SCI) initiative and a working group to advance its development. “The physical access control industry has demonstrated a need for a universally compatible
Berlin, 10. March, 2021 – The introduction of the Covid-19 vaccines across the globe has prompted discussions on the need for vaccination documentation. Veridos, a world-leading provider of integrated identity solutions, explains the five prerequisites of a secure and effective
Nov 14, 2019 -- ePasslet Suite v3 – cryptovision’s Java card framework for electronic ID documents – will be available in 2020 on SECORA™ ID, Infineon’s new Java card operating system. Using ePasslet Suite, users of SECORA™ ID can easily and flexibly
Entrust Datacard Earns Frost & Sullivan North American Product Leadership Award for its IoT Cybersecurity Solution, ioTrust
Santa Clara, CA, United States, 2019/07/25 - Based on its recent analysis of the North American Internet of Things (IoT) cybersecurity market, Frost & Sullivan recognizes Entrust Datacard Corporation with the 2019 North American Product Leadership Award for its ioTrust
HONG KONG, 29 May, 2019 - Advanced Card Systems Ltd. (ACS), Asia Pacific's top supplier and one of the world's top 3 suppliers of PC-linked smart card readers (Source: Frost & Sullivan), exhibits in Securing Federal Identity 2019 from 4