📖 What is Certificate Revocation List (CRL)?
Certificate Revocation List (CRL) is a list of digital certificates that have been revoked by the issuing Certificate Authority before their scheduled expiration date. Clients check this list to ensure a certificate is still valid and trusted.
"Student, remember that CRLs can become very large and create latency issues, which leads to the need for OCSP."
📚 Certification: Certified Information Systems Security Professional (CISSP)
🔑 What are the Key Concepts of Certificate Revocation List (CRL)?
- ▸ The Certificate Authority (CA) is responsible for maintaining and digitally signing the CRL to ensure the list's integrity and authenticity.
- ▸ Certificates are added to the CRL for various reasons, including private key compromise, CA compromise, or a change in the user's affiliation.
- ▸ CRLs are hosted at CRL Distribution Points (CDPs), which are specific URLs embedded within the digital certificate for clients to locate.
- ▸ As the number of revoked certificates grows, the CRL size increases, leading to significant bandwidth consumption and increased latency during validation.
- ▸ CRLs include a 'next update' field, specifying when the next list will be published, which determines how long a client caches the list.
🎯 How does Certificate Revocation List (CRL) appear on the CISSP Exam?
A scenario might describe a situation where a private key is compromised; you will be asked to identify the process of adding that certificate to the CRL to prevent further unauthorized use.
You may be asked to analyze a performance bottleneck during the TLS handshake process and determine if the size of the CRL is causing excessive network latency for clients.
Expect questions where you must compare CRLs with OCSP, specifically focusing on the trade-off between downloading a full list of revoked certificates versus performing a real-time status request for a single certificate.
❓ Frequently Asked Questions
How does a CRL differ from OCSP in terms of efficiency?
CRLs require the client to download the entire list of revoked certificates, which is inefficient for large populations. OCSP allows the client to query the status of a specific certificate, providing a faster, more scalable, real-time response.
What happens if a client cannot reach the CRL Distribution Point?
Depending on the security policy, the client may 'fail-open' (accept the certificate) or 'fail-closed' (reject it). In high-security CISSP contexts, failing-closed is preferred to ensure no revoked certificates are accidentally trusted.
Why must the CRL itself be digitally signed?
Because the CRL is a critical security component, it must be signed by the CA. This prevents an attacker from maliciously modifying the list to remove a revoked certificate and regain unauthorized access.