Certificate Revocation List (CRL)
Why CRL Is Important
CRLs are the original mechanism for certificate revocation but have significant scalability problems. A busy CA may revoke thousands of certificates, and clients must download the entire list to check a single certificate. This wastes bandwidth and adds latency, especially on mobile networks.
Despite their limitations, CRLs still play a role. Some enterprise environments and older systems rely on CRLs. Chrome uses a compressed form called CRLSets that covers high-priority revocations. Understanding CRLs helps you understand why your certificate might still appear trusted even after revocation - if the client has not refreshed its CRL cache, it will not know the certificate was revoked.
For website operators, the practical takeaway is that revocation checking is imperfect across all mechanisms. If your private key is compromised, you should revoke the certificate through your CA, but also immediately replace it with a new one and update your server configuration. Do not rely solely on revocation to protect your users.
How to Verify
Inspect the certificate's CRL Distribution Points and the issuing CA's current documentation. Revocation use is client-specific, and a website scanner cannot prove how every browser or non-browser client will consume the data.
Check SSL Certificate