CRL (Certificate Revocation List)
Definition
Frequently asked questions
Why revoke a certificate before it expires?
Because a certificate can cease to be trustworthy at any time. The private key may have been compromised or lost, the information it contains may have changed, its holder may have left the organization, or the authority may have found an error during issuance. Revocation informs third parties that they should no longer rely on this certificate.
What is the difference between CRL and OCSP?
CRL is a complete list of revoked certificates, published at regular intervals, which the software downloads and then consults. OCSP is an online query protocol: the software requests the status of a single certificate and receives a signed response. OCSP is lighter and more up-to-date; CRL works without a connection once downloaded.
Does a signature remain valid if the certificate is revoked afterwards?
Yes, if it was created before the revocation. What matters is the status of the certificate at the time of signing. However, you must be able to prove this date: that is the role of timestamping. Without it, it becomes difficult to establish that a signature is prior to the revocation of the certificate that was used to create it.
How often is a CRL updated?
The frequency is set by the certification policy of each authority. Each list indicates the date of its next publication, which allows software to know whether the one it has is still current. For qualified certificates, standards require that revocation information be made available within short timeframes.
Related guides
Related terms
Ready to Put These Concepts Into Practice?
Certyneo allows you to create eIDAS-compliant signature envelopes in just a few clicks, without installation.