What does CRL stand for?
CRL stands for Certificate Revocation List. A list, published by a certificate authority, of certificates revoked before their expiry date. Clients download it to check a certificate is still trusted.
A CRL is a list, signed by a certificate authority, of the serial numbers of certificates it has revoked before their expiry date, for example because a private key was stolen or an employee left. The authority publishes a new list at regular intervals at an address written inside each certificate. A client downloads the list and checks whether the certificate in front of it appears there. The weaknesses are size and delay: a revocation only becomes visible when the next list is published and fetched.
CRL in practice: an example
A laptop holding a VPN client certificate is stolen. The administrator revokes the certificate, and its serial number is included in the next CRL. From the moment the VPN gateway loads the new list, the stolen laptop's certificate is refused.
What CRL is confused with
CRL vs OCSP: what is the difference?
A CRL is the full list, downloaded periodically. OCSP is a live query about a single certificate. Both answer the same question: has this certificate been revoked? What OCSP stands for
CRL vs certificate expiry: what is the difference?
Expiry is the planned end of a certificate's life, written in the certificate. Revocation is an early cancellation, and it is only visible through a CRL or OCSP.
Which exams cover CRL?
CRL is on the official CompTIA acronym list for one of the four exams covered here.
- Security+ SY0-801: 1.3 (General Security Concepts).
Each number is a CompTIA exam objective and the name in brackets is its domain. The exam puts the term in a scenario; it does not ask you to recite the expansion.
Check yourself: two practice questions
Written by CertSprint for this page. They are not taken from any exam.
1. An employee leaves and her smart card certificate must stop working today, eleven months before it expires. What does the administrator do?
- Wait for the certificate to expire
- Revoke the certificate so that it appears on the CRL
- Generate a certificate signing request
- Rename the user account
Show the answer
B. Revoke the certificate so that it appears on the CRL. Revocation cancels a certificate before its expiry date. Systems that check the CRL will then refuse it.
2. What is a known disadvantage of relying only on CRLs?
- They cannot be signed
- A revocation is not seen until the next list is published and downloaded
- They work only for email certificates
- They contain private keys
Show the answer
B. A revocation is not seen until the next list is published and downloaded. Lists are issued periodically, so there is a window in which a revoked certificate is still accepted by clients holding the older list.
Sources: RFC 5280: Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile; NIST glossary: certificate revocation list. The acronym and its expansion come from CompTIA's official acronym lists, linked from each exam glossary above. The explanation, example and questions are CertSprint's own, checked against these sources on 11 November 2026.